你有你需要的东西。您只需将其曝光以供查看/捕获等。
下面的示例是使用原始的Windows沙盒,配置日志,创建一个简单的任务,运行一次,并获取结果。
wevtutil set-log Microsoft-Windows-TaskScheduler/Operational /enabled:true
wevtutil get-log Microsoft-Windows-TaskScheduler/Operational
Get-WinEvent -ListLog * |
Where-Object -Property logname -match task
# Results
<#
LogMode MaximumSizeInBytes RecordCount LogName
------- ------------------ ----------- -------
Circular 10485760 37 Microsoft-Windows-TaskScheduler/Operational
Circular 1052672 8 Microsoft-Windows-TaskScheduler/Maintenance
Circular 1052672 0 Microsoft-Windows-Shell-Core/LogonTasksChannel
Circular 1052672 0 Microsoft-Windows-Mobile-Broadband-Experience-Parser-Task/Operational
Circular 1052672 0 Microsoft-Windows-BackgroundTaskInfrastructure/Operational
#>
$XmlQuery = @'
<QueryList>
<Query Id="0" Path="Microsoft-Windows-TaskScheduler/Operational">
<Select Path="Microsoft-Windows-TaskScheduler/Operational">
*[EventData/Data[@Name='taskname']='\TestTask']
</Select>
</Query>
</QueryList>
'@
Get-WinEvent -FilterXml $XmlQuery
# Results
<#
ProviderName: Microsoft-Windows-TaskScheduler
TimeCreated Id LevelDisplayName Message
----------- -- ---------------- -------
11/16/2020 2:52:16 PM 102 Information Task Scheduler successfully finished "{ca247629-6342-4e3d-9848-af234f84ae0c}" instance of the "\TestTask" task for user "F2B00BB4-0260...
11/16/2020 2:52:16 PM 201 Information Task Scheduler successfully completed task "\TestTask" , instance "{ca247629-6342-4e3d-9848-af234f84ae0c}" , action "C:\Windows\System...
11/16/2020 2:52:08 PM 110 Information Task Scheduler launched "{ca247629-6342-4e3d-9848-af234f84ae0c}" instance of task "\TestTask" for user "WDAGUtilityAccount" .
11/16/2020 2:52:08 PM 200 Information Task Scheduler launched action "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" in instance "{ca247629-6342-4e3d-9848-af234...
11/16/2020 2:52:08 PM 100 Information Task Scheduler started "{ca247629-6342-4e3d-9848-af234f84ae0c}" instance of the "\TestTask" task for user "F2B00BB4-0260-4\WDAGUtility...
11/16/2020 2:52:08 PM 129 Information Task Scheduler launch task "\TestTask" , instance "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" with process ID 5520.
11/16/2020 2:52:04 PM 106 Information User "F2B00BB4-0260-4\WDAGUtilityAccount" registered Task Scheduler task "\TestTask
#>
($events = @(
Get-WinEvent -FilterXml $XmlQuery -ErrorAction Stop
)) |
Where-Object {$PSItem.ID -eq 106} |
Select-Object -Property '*' -First 1 |
Format-List -Force
<#
Message : User "F2B00BB4-0260-4\WDAGUtilityAccount" registered Task Scheduler task "\TestTask"
Id : 106
Version : 0
Qualifiers :
Level : 4
Task : 106
Opcode : 0
Keywords : -9223372036854775808
RecordId : 1
ProviderName : Microsoft-Windows-TaskScheduler
ProviderId : de7b24ea-73c8-4a09-985d-5bdadcfa9017
LogName : Microsoft-Windows-TaskScheduler/Operational
ProcessId : 960
ThreadId : 1440
MachineName : f2b00bb4-0260-425b-b5d3-7b0331e05b80
UserId : S-1-5-18
TimeCreated : 11/16/2020 2:52:04 PM
ActivityId :
RelatedActivityId :
ContainerLog : Microsoft-Windows-TaskScheduler/Operational
MatchedQueryIds : {}
Bookmark : System.Diagnostics.Eventing.Reader.EventBookmark
LevelDisplayName : Information
OpcodeDisplayName : Info
TaskDisplayName : Task registered
KeywordsDisplayNames : {}
Properties : {System.Diagnostics.Eventing.Reader.EventProperty, System.Diagnostics.Eventing.Reader.EventProperty}
#>
(($events = @(
Get-WinEvent -FilterXml $XmlQuery -ErrorAction Stop
)) |
Where-Object {$PSItem.ID -eq 106} |
Select-Object -Property '*' -First 1).Message
# Results
<#
User "F2B00BB4-0260-4\WDAGUtilityAccount" registered Task Scheduler task "\TestTask"
#>
(($events = @(
Get-WinEvent -FilterXml $XmlQuery -ErrorAction Stop
)) |
Where-Object {$PSItem.ID -eq 106} |
Select-Object -Property '*' -First 1).Opcode
# Results
<#
0
#>
# Code Reference
<#
Op Codes Description
________ ____________
0 or 0x0 The operation completed successfully.
1 or 0x1 Incorrect function called or unknown function called.
2 or 0x2 File not found.
10 or 0xa The environment is incorrect.
0x41300 Task is ready to run at its next scheduled time.
0x41301 Task is currently running.
0x41302 Task is disabled.
0x41303 Task has not yet run.
0x41304 There are no more runs scheduled for this task.
0x41306 Task is terminated.
0x8004131F An instance of this task is already running.
0x800704DD The service is not available (is âRun only when a user is logged onâ checked?)
0xC000013A The application terminated as a result of a CTRL+C.
0xC06D007E Unknown software exception.
#>