How to make SCHTASKS /Query display the "multiple actions" attribute in query result?

I want to display all details about a certain task.

For example, I have a "MyTask" that has multiple programs to run as actions, shown below:

I want to see the list of programs that the task runs in the command line version of task scheduler (or: schtasks).

So when I run:

SCHTASKS /Query /TN "\Microsoft\Windows\MyTask" /FO list /v

But I only get the phrase "multiple actions" instead of the actual actions / program to be run as shown below:

I know I could use the /XML argument to show the list of the programs to be run, but what if I have many tasks to generate results for? I want my output to be a list i.e. /FO list

How do I solve this?

0

2 Answers

Batch Script List All Task Scheduler Job Names and Commands

I've provided batch script below that will run from Windows 7 and Windows 10.

Essentially this will:

1. Run schtasks with the /XML switch and pipe all the XML content it reads through the findstr command with the I switch (case insensitive) filtering it to only redirect the lines that contain the <!-- and <command> strings as ouput to a flat file.
2. The flat file content is then run through a dynamic PowerShell script that will replace the XML tags with more appropriately formatted field names, trim any leading white space from all lines, remove all blank line, and lastly put a new line before each of the Task Name fields but it'll skip the first line as it won't need to have a line before it—the topmost line in the file.

Note: See the Gotchas section below for potential anomaly detail and items to note.

---

The Batch Script

@ECHO ON
SET RptFile=%temp%\TaskSchedReport.txt
:: -- This routine sets temp files
SET RptFileTmp=%temp%\~tmpTaskSchedReport.txt
IF EXIST "%RptFileTmp%" DEL /Q /F "%RptFileTmp%"
SET TmpPSScript=%Temp%\~tmpScheduleTasks.ps1
IF EXIST "%TmpPSScript%" DEL /Q /F "%TmpPSScript%"
:SchTask
schtasks /query /XML | Findstr /I "<!-- <command>">"%RptFileTmp%"
:PowerShell
ECHO $origFile = "%RptFileTmp%" >> "%TmpPSScript%"
ECHO $NewFile = "%RptFile%" >> "%TmpPSScript%"
ECHO $BlankLine = "`r`n" >> "%TmpPSScript%"
ECHO (Get-Content $origFile) ^| Foreach-Object { >> "%TmpPSScript%"
ECHO $_ -replace "<!-- ", 'Task Name (and path): ' -replace "<Command>", 'Command: ' -replace "<[^>]+>", '' -replace '^^\s+', '' -replace '(?m)^^\s*\r?\n', ''>> "%TmpPSScript%"
ECHO } ^| Set-Content $NewFile >> "%TmpPSScript%"
ECHO (Get-Content $NewFile) ^| ? {$_.trim() -ne "" } ^| Set-Content $NewFile >> "%TmpPSScript%"
ECHO (Get-Content $NewFile) ^| Foreach-Object { >> "%TmpPSScript%"
ECHO $_ -replace "Task Name ", ($BlankLine + "Task Name ") -replace "-->", '' >> "%TmpPSScript%"
ECHO } ^| Set-Content $NewFile >> "%TmpPSScript%"
ECHO (Get-Content $NewFile ^| Select-Object -Skip 1) ^| Set-Content $NewFile >> "%TmpPSScript%"
SET PowerShellDir=C:\Windows\System32\WindowsPowerShell\v1.0
CD /D "%PowerShellDir%"
Powershell -ExecutionPolicy Bypass -Command "& '%TmpPSScript%'"
:: -- Below will open file to view content with the default text editor
explorer.exe "%RptFile%"

---

Results

Task Name (and path): \Adobe Acrobat Update Task
Command: C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Task Name (and path): \GoogleUpdateTaskMachineCore
Command: C:\Program Files\Google\Update\GoogleUpdate.exe
Task Name (and path): \GoogleUpdateTaskMachineUA
Command: C:\Program Files\Google\Update\GoogleUpdate.exe
Task Name (and path): \TopSecret
Command: C:\Folder\CIA.exe
Command: C:\Folder\FBI.exe

---

Gotchas

If you notice a Task Name field item with no Command field item beneath it, that appears to be due to system scheduled tasks, etc. that have Actions listed as Custom Handler values than cannot be edited see examples and screen shot below.

Example (no commands)

Task Name (and path): \Microsoft\Windows\Shell\WindowsParentalControls
Task Name (and path): \Microsoft\Windows\Shell\WindowsParentalControlsMigration
Task Name (and path): \Microsoft\Windows\SideShow\AutoWake
Task Name (and path): \Microsoft\Windows\SideShow\GadgetManager
Task Name (and path): \Microsoft\Windows\SideShow\SessionAgent
Task Name (and path): \Microsoft\Windows\SideShow\SystemDataProviders 

Task Scheduler Job Settings (ones with no commands/actions)

---

Further Resources

• SCHTASKS
• Findstr
• Regular Expressions
• Get-Content
• ForEach-Object
• Replace
• Set-Content
• Trim()
• Comparison Operators
• Select

6

Since you say: "I want to still see the task names in relation to what their actions are" in the comment then you can use the below example batch script to get you the expected output with Windows 7.

Essentially this will:

1. Run the verbose schtasks query command to dump the output to a csv file
2. With the Windows native PowerShell convertfrom-csv command, it'll convert the csv output to a list like format.
3. From there it'll use the PowerShell select command with the -property switch to get only the values from the fields you want to see only.
4. The PowerShell where command with -notcontains comparison operator will filter out extra TaskName objects that for whatever reason dumps to the csv file with the schtasks commands.

Note: You're more limited with what you can and cannot use natively for this task with Windows 7 than you are with newer Windows OSes such as Windows 10.

Batch Script Explicit

You may need to play with the -Width 256 parameter and use larger or smaller int.

@ECHO ON
SET RptFile=C:\Folder\Path\TaskSchedReport.txt
SET TmpPSScript=%Temp%\~tmpScheduleTasks.ps1
IF EXIST "%TmpPSScript%" DEL /Q /F "%TmpPSScript%"
ECHO schtasks /query /v /fo csv ^| ConvertFrom-CSV ^| >> "%TmpPSScript%"
ECHO Select -Property "TaskName","Task To Run" ^| >> "%TmpPSScript%"
ECHO Where {$_.TaskName -notcontains "TaskName"} ^| >> "%TmpPSScript%"
ECHO Out-File "%RptFile%" -Width 256 >> "%TmpPSScript%"
SET PowerShellDir=C:\Windows\System32\WindowsPowerShell\v1.0
CD /D "%PowerShellDir%"
Powershell -ExecutionPolicy Bypass -Command "& '%TmpPSScript%'"
:: -- Below will open file to view content with the default text editor
explorer.exe "%RptFile%"
EXIT

Batch Output Snippet

TaskName Task To Run
-------- -----------
\Adobe Acrobat Update Task C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
\Adobe Acrobat Update Task C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
\GoogleUpdateTaskMachineCore C:\Program Files\Google\Update\GoogleUpdate.exe /c
\GoogleUpdateTaskMachineCore C:\Program Files\Google\Update\GoogleUpdate.exe /c
\GoogleUpdateTaskMachineUA C:\Program Files\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan c:\Program Files\Microsoft Security Client\\MpCmdRun.exe Scan -ScheduleJob -RestrictPrivileges
\Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Automated) COM handler
\Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Automated) COM handler
\Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Manual) COM handler
\Microsoft\Windows\Autochk\Proxy %windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations 

Batch Script Everything

@ECHO ON
SET RptFile=C:\Folder\Path\TaskSchedReport.txt
SET TmpPSScript=%Temp%\~tmpScheduleTasks.ps1
IF EXIST "%TmpPSScript%" DEL /Q /F "%TmpPSScript%"
ECHO schtasks /query /v /fo csv ^| ConvertFrom-CSV ^| >> "%TmpPSScript%"
ECHO Where {$_.TaskName -notcontains "TaskName"} ^| >> "%TmpPSScript%"
ECHO Out-File "%RptFile%" -Width 256 >> "%TmpPSScript%"
SET PowerShellDir=C:\Windows\System32\WindowsPowerShell\v1.0
CD /D "%PowerShellDir%"
Powershell -ExecutionPolicy Bypass -Command "& '%TmpPSScript%'"
:: -- Below will open file to view content with the default text editor
explorer.exe "%RptFile%"
EXIT

---

Native PowerShell Explicit

As a bonus I included the straight PowerShell syntax you can use to see the results. Test with and without without the | FL and compare results.

schtasks /query /v /fo csv | ConvertFrom-CSV |
Select -Property "TaskName","Task To Run" |
Where {$_.TaskName -notcontains "TaskName"} | FL

Native PowerShell Everything

schtasks /query /v /fo csv | ConvertFrom-CSV |
Where {$_.TaskName -notcontains "TaskName"} | FL

---

Further Resources

• ConvertFrom-Csv
• Select
• Where
• Comparison Operators
• SCHTASKS

4

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password Submit

Post as a guest

Post Your Answer Discard

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy