Event ID 4699ScheduledTaskP2
Windows Event ID 4699: A scheduled task was deleted
Event ID 4699 records deletion of a scheduled task.
- Applicable version
- Windows Server 2016 and later; Windows 10 and later
- Last reviewed
- 2026-07-11
Trigger Scenarios
It is generated when Task Scheduler auditing records task removal.
Key Fields
Task Name
The deleted task path; preserve it for comparison with known baselines.
Subject
The account deleting the task.
Task Content
Where retained, identifies the removed command and trigger.
Common False Positives
- Software updaters remove obsolete tasks.
- Administrators clean up maintenance tasks.
Related Events
MITRE ATT&CK Mapping
- T1070.004Indicator Removal: File Deletion
Detection Notes
T1070.004 cleanup is indicated when a Task Name deleted by 4699 was created by 4698 or changed by 4702 within a short 60-minute window, especially when its captured Task Content references C:\\Users\\ or powershell.exe. Preserve prior Task Content before deletion.
SecurityEvent
| where EventID == 4699
| project TimeGenerated, Computer, Account, TaskNameindex=wineventlog EventCode=4699 | table _time, host, SubjectUserName, TaskNameTask Name: \Microsoft\Windows\Update\CacheRefresh
Subject: CORP\admin.ops