Windows Event ID 4701: A scheduled task was disabled
Windows Security Event ID 4701 records that a scheduled task was disabled.
- Applicable version
- Windows Server 2008 and later where the audit subcategory is enabled
- Last reviewed
- 2026-07-13
Trigger Scenarios
Microsoft documents that this event is generated every time a scheduled task is disabled.
Key Fields
Task Name
The disabled task path. Microsoft recommends monitoring critical tasks that should never be disabled.
Task Content
Task XML content that can identify the disabled command, trigger, and principal.
Subject Logon ID
Hexadecimal logon session for the account disabling the task.
Common False Positives
- Maintenance windows may disable noisy or deprecated scheduled tasks.
- Endpoint management software can temporarily disable vendor tasks during updates.
Related Events
MITRE ATT&CK Mapping
- T1562.001Impair Defenses: Disable or Modify Tools
Detection Notes
Use threshold=1 for Task Name values tied to backups, EDR, logging, or vulnerability scanning that should never be disabled. Microsoft recommends monitoring 4701 for critical tasks; disabling a defensive scheduled task with Task Content pointing to C:\Program Files\SecurityAgent or a backup script is T1562.001 Disable or Modify Tools. Correlate Subject Logon ID with 4624/4688 and look for adjacent 4699 deletion or 4702 update.
SecurityEvent
| where EventID == 4701
| project TimeGenerated, Computer, Account, TaskName, TaskContentindex=wineventlog EventCode=4701 | table _time, host, Account_Name, Task_Name, Task_ContentEventID: 4701
Subject Logon ID: 0x42a91
Task Name: \SecurityAgent\DailyScan
Task Content: <Command>C:\Program Files\SecurityAgent\scan.exe</Command>