Event ID 4702ScheduledTaskP2

Windows Event ID 4702: A scheduled task was updated

Event ID 4702 records modification of a scheduled task definition.

Applicable version: Windows Server 2016 and later; Windows 10 and later
Last reviewed: 2026-07-11

Trigger Scenarios

Task Scheduler auditing logs the event when a registered task is changed.

Key Fields

Task Name

The changed task identifier.

Task Content

Compare the XML before and after; Command, Arguments, Principal, and Trigger are decisive.

Subject

The identity applying the change.

Common False Positives

Management products update their scheduled tasks.
Administrators revise approved maintenance tasks.

Related Events

MITRE ATT&CK Mapping

T1053.005Scheduled Task/Job: Scheduled Task

Detection Notes

T1053.005 modification is indicated when Task Content changes <Command> to powershell.exe, cmd.exe, mshta.exe, or a C:\\ProgramData\\ / C:\\Users\\ executable, or changes Principal to SYSTEM. Compare before-and-after XML, not the task name alone.

Microsoft Sentinel KQL

SecurityEvent
| where EventID == 4702
| project TimeGenerated, Computer, Account, TaskName, TaskContent

Splunk SPL

index=wineventlog EventCode=4702 | table _time, host, SubjectUserName, TaskName, TaskContent

Sample Log

Task Name: \Microsoft\Windows\Update\CacheRefresh
Task Content: <Command>powershell.exe</Command>
Subject: CORP\admin.ops

Source

Official documentation Machine-readable JSON