How can I monitor scheduled tasks on my server? I need to determine whether unauthorized jobs have been added. Can I glean this type of activity from the Security log?
If you use Windows Server 2003, you can obtain information about unauthorized jobs. Microsoft added a new event ID to Windows 2003 for tracking newly created scheduled tasks. First, you need to enable Audit process tracking. Then, you'll see event ID 602 in the server's Security log, which Figure 2 shows, whenever someone adds a scheduled task. As you can see, Windows logs the user profile that added the task, the task's filename, the command the task will run, and the task's triggers.