Jump to content
Strawberry Orange Banana Lime Leaf Slate Sky Blueberry Grape Watermelon Chocolate Marble
Strawberry Orange Banana Lime Leaf Slate Sky Blueberry Grape Watermelon Chocolate Marble

MSFN is made available via donations, subscriptions and advertising revenue. The use of ad-blocking software hurts the site. Please disable ad-blocking software or set an exception for MSFN. Alternatively, register and become a site sponsor/subscriber and ads will be disabled automatically. 


Sign in to follow this  
Jody Thornton

Task Scheduler: Cannot Remove "Scheduled Start" Task

Recommended Posts

I'm sure I'll be worth the trouble. SC.EXE and perhaps NirSoft's NIRCMD.EXE may help you at that. As well as a little hand from @jaclaz, of course! I bet you'll get it working sooner than you imagine! :yes:

  • Like 1

Share this post


Link to post
Share on other sites

I don't know what that machinepolicy trigger is supposed to be, just noticed it causes the service to start on cold boot.

I didn't take Windows Defender into account, just assumed it would work after seeing it didn't reset on reboot.

What about taking the ownership of the file, disabling inherited permissions and just set one entry - Everyone - to allow just read-only access?

Scheduled Start task by itself doesn't do anything beyond starting the service. I also don't remember ever seeing the service updating Windows Update state if updates were disabled, always have to check manually.

No idea what messes with those tasks; I noticed it gets enabled on reboot with Windows Defender service disabled, so some core component/service must be responsible.

  • Like 1

Share this post


Link to post
Share on other sites
49 minutes ago, UCyborg said:

What about taking the ownership of the file, disabling inherited permissions and just set one entry - Everyone - to allow just read-only access?
 

Hmmmmmm - now we're cooking.  I shall let you know!

Share this post


Link to post
Share on other sites

That's strange, I just re-enabled Windows Defender, updated its definitions and the task did stay disabled. At least on my end, the only other user with write access to the file is the administrators group, so nobody except me should be able to modify it. Though setting just Everyone to read-only access should be the most thorough action that can be accomplished by messing with permissions alone.

The only Windows 8 installations I have for testing is Windows 8.0 with zero updates and Windows 8.1 with only security updates 'till December 2017. There should be something out there available to monitor file access. Process Monitor perhaps? Maybe it can help determine what changes the task.

Edit: Forgot to mention, I noticed having Windows Defender enabled does cause Windows Update service to start at boot, that is, with both scheduled task disabled and that machine policy trigger removed.

Edited by UCyborg
  • Like 1

Share this post


Link to post
Share on other sites

I gave the SYSTEM account "Deny" access to the task file.  So far, the task has remained disabled.

Windows Defender does allow manual update checks.  No updates since 8:25 am EST.  And the Windows Updates service does start as needed.

 

Share this post


Link to post
Share on other sites

Funny - I posted this question over at the DM Windows 8 forum.  They're friggin' useless over there.  Not even a single thread comment.

Just in case you want to hear what crickets chirping sounds like:

https://www.eightforums.com/threads/task-scheduler-cannot-remove-scheduled-start-task.78706/

 

Share this post


Link to post
Share on other sites

We have success.  I have updated Windows Defender. and attempted running a manual update.  BITS and Windows Update come on as needed, and then go back off eventually.  Both services are set to Manual.   But most importantly, the Scheduled Task entry never regenerates or starts.  It has remained "Disabled"

I want to thank everyone for their help.  @UCyborg, @dencorso and @HarryTri, I appreciate all of your help.

 

  • Like 2

Share this post


Link to post
Share on other sites
On 10/18/2018 at 1:58 PM, Jody Thornton said:

I gave the SYSTEM account "Deny" access to the task file.  So far, the task has remained disabled.

So that tweak was the one that did it, right? One has to remove the custom trigger, disable the task and deny SYSTEM access to it, right?

Share this post


Link to post
Share on other sites

You can disable the task without removing custom trigger first, its presence just prevents other task properties from being edited in the GUI, disabling works either way. Whatever that task's custom trigger is for, it's disabled by default. This is its description in the task's file (XML):

<WnfStateChangeTrigger>
  <Enabled>false</Enabled>
  <StateName>7508BCA3380C960C</StateName>
  <Data>01</Data>
  <DataOffset>0</DataOffset>
</WnfStateChangeTrigger>

Whatever that means.

Share this post


Link to post
Share on other sites

You're both right.  So yes I removed the Custom Trigger.  That allowed me to edit the properties of the Scheduled Start task.  Then I removed the "One Time" event trigger.  I saved the task, and then disabled it.

Then I applied a Deny permission to the System Account on the file itself.

  • Like 1

Share this post


Link to post
Share on other sites

So next I was attacking automatic Defrag that shows up in Event Log.  It completes a boot optimization, even though I disabled Automatic optmization.  I use "My Defrag" anyway for boot optimization, so I disabled the "Optimize Drives" services.  That should do it  :)

Knocking off these little bug-a-boos one step at a time :)

 

  • Like 1

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.

×