Windows Event ID 4700: A scheduled task was enabled
- Applicable version
- Windows Server 2008 and later where the audit subcategory is enabled
- Last reviewed
- 2026-07-22
Quick summary
Windows Security Event ID 4700 records that a scheduled task was enabled.
Technical Metadata
| Event ID | 4700 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| Audit keyword | Audit Success |
| MITRE ATT&CK | TA0003 Persistence / T1053.005 Scheduled Task/Job: Scheduled Task |
| Key fields to watch | Task Name, Task Content, Subject Logon ID |
Trigger Scenarios
Microsoft documents that this event is generated every time a scheduled task is enabled.
Key Fields
Task Name
The enabled task path. Microsoft recommends monitoring critical tasks that should never be enabled.
Task Content
Task XML content that can expose command, arguments, trigger, and principal context.
Subject Logon ID
Hexadecimal logon session for the account enabling the task.
Threat Hunting Queries
SecurityEvent
| where EventID == 4700
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields described on this page.
index=wineventlog source="WinEventLog:Security" EventCode=4700
| table _time, host, EventCode, Message- Data source
- Splunk Windows Security event data
- Assumptions
- Index, source, and parsed field names vary by deployment. Apply the documented field conditions after validating local field extraction.
dataset = microsoft_windows_raw
| filter edr_event_id = 4700- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
title: Windows Security Event ID 4700
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4700
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Security log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the event-specific conditions and correlations documented on this page.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| EventID | 4700 | A scheduled task was enabled. | Interpret EventID with the other documented fields and correlated events; this value alone is not proof of compromise. Source |
| TaskName | \TaskName | The full scheduled-task path that was enabled. | Interpret TaskName with the other documented fields and correlated events; this value alone is not proof of compromise. Source |
MITRE ATT&CK Mapping
- T1053.005Scheduled Task/Job: Scheduled Task
Detection Notes
Use threshold=1 for critical Task Name values that should never be enabled, as Microsoft recommends. Task Name in the Task Scheduler Library root such as \Updater or Task Content running powershell.exe from C:\Users\Public supports T1053.005 Scheduled Task when an actor reactivates persistence. Correlate Subject Logon ID with 4624/4688 and compare Task Content against the approved baseline.
Common False Positives
- Administrators may enable tasks during maintenance or application deployment.
- Vendor updaters can re-enable their own disabled tasks.
Related Events
Sample Log
EventID: 4700
Subject Logon ID: 0x42a91
Task Name: \Updater
Task Content: <Command>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Command>Frequently Asked Questions
What does Windows Event ID 4700 mean?
A previously disabled scheduled task was enabled.
Does Event ID 4700 always indicate malicious activity?
No. Maintenance, deployment, and administrative workflows commonly enable tasks.
How should Event ID 4700 be investigated?
Inspect TaskName and TaskContent, then resolve SubjectLogonId to the initiating logon and process.
Sources
- 4700: A scheduled task was enabled
Microsoft · vendor
- Scheduled Task/Job: Scheduled Task (T1053.005)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule