Windows Event ID 4701: A scheduled task was disabled
- Applicable version
- Windows Server 2008 and later where the audit subcategory is enabled
- Last reviewed
- 2026-07-22
Quick summary
Windows Security Event ID 4701 records that a scheduled task was disabled.
Technical Metadata
| Event ID | 4701 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| Audit keyword | Audit Success |
| MITRE ATT&CK | TA0005 Defense Evasion / T1562.001 Impair Defenses: Disable or Modify Tools |
| Key fields to watch | Task Name, Task Content, Subject Logon ID |
Trigger Scenarios
Microsoft documents that this event is generated every time a scheduled task is disabled.
Key Fields
Task Name
The disabled task path. Microsoft recommends monitoring critical tasks that should never be disabled.
Task Content
Task XML content that can identify the disabled command, trigger, and principal.
Subject Logon ID
Hexadecimal logon session for the account disabling the task.
Threat Hunting Queries
SecurityEvent
| where EventID == 4701
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields described on this page.
index=wineventlog source="WinEventLog:Security" EventCode=4701
| table _time, host, EventCode, Message- Data source
- Splunk Windows Security event data
- Assumptions
- Index, source, and parsed field names vary by deployment. Apply the documented field conditions after validating local field extraction.
dataset = microsoft_windows_raw
| filter edr_event_id = 4701- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
title: Windows Security Event ID 4701
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4701
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Security log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the event-specific conditions and correlations documented on this page.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| EventID | 4701 | A scheduled task was disabled. | Interpret EventID with the other documented fields and correlated events; this value alone is not proof of compromise. Source |
| TaskName | \TaskName | The full scheduled-task path that was disabled. | Interpret TaskName with the other documented fields and correlated events; this value alone is not proof of compromise. Source |
MITRE ATT&CK Mapping
- T1562.001Impair Defenses: Disable or Modify Tools
Detection Notes
Use threshold=1 for Task Name values tied to backups, EDR, logging, or vulnerability scanning that should never be disabled. Microsoft recommends monitoring 4701 for critical tasks; disabling a defensive scheduled task with Task Content pointing to C:\Program Files\SecurityAgent or a backup script is T1562.001 Disable or Modify Tools. Correlate Subject Logon ID with 4624/4688 and look for adjacent 4699 deletion or 4702 update.
Common False Positives
- Maintenance windows may disable noisy or deprecated scheduled tasks.
- Endpoint management software can temporarily disable vendor tasks during updates.
Related Events
Sample Log
EventID: 4701
Subject Logon ID: 0x42a91
Task Name: \SecurityAgent\DailyScan
Task Content: <Command>C:\Program Files\SecurityAgent\scan.exe</Command>Frequently Asked Questions
What does Windows Event ID 4701 mean?
An enabled scheduled task was disabled.
Does Event ID 4701 always indicate malicious activity?
No. Task retirement and maintenance can be legitimate.
How should Event ID 4701 be investigated?
Determine whether the task provides security, backup, or logging functions and correlate SubjectLogonId with process activity.
Sources
- 4701: A scheduled task was disabled
Microsoft · vendor
- Impair Defenses: Disable or Modify Tools (T1562.001)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule