Task Scheduler Change Audit Trail

Background

Walked in today to some questions about why an important scheduled tasks <cringe face here> had been disabled. Turned out that it was intentional so no big deal. However, the question I was asked before we knew it was intentional was this… “how do we see an audit trail for task scheduler changes?” The short answer is that it’s not enabled by default and it’s not super intuitive.

This has to be auditpol.exe

More Here

http://technet.microsoft.com/en-us/library/cc731451.aspx

Auditing consists of categories and subcategories. To do this you need to enable a subcategory. Technically, this is the recommended way to enable non-standard auditing. You don’t want to audit too much or you’ll make your log difficult to read, fill up space, consume processing time, etc. Per Micrsoft…

            http://technet.microsoft.com/en-us/library/cc766468%28v=ws.10%29.aspx

If you are going to use auditing subcategories, you should not use Group Policy to define and distribute your auditing policies. The Group Policy Management Console configures only the top-level auditing categories and enables all of the subcategories within the category and thus cannot be used to set more targeted audit policy. Instead, auditing policy that uses auditing subcategories must be defined by using the command-line tool auditpol.exe and distributed by means of a script.

Execution

So how do I do that? Pretty simple:

From a command prompt:

auditpol.exe /get /category:"Object Access"

I can see that I'm currently set to all "Failure" only which inherited from the Local Policy parent "Object Access". I want to change "Other Object Access Events" which is sort of a misc set of audit events for Task Scheduler and COM+. 

http://technet.microsoft.com/en-us/library/dn319119.aspx

All of that to say, here is the command to enable Task Scheduler auditing to the Event Viewer Security logs.

auditpol.exe /set /subcategory:"Other Object Access Events" /Success:Enabled /Failure:Enabled

You can verify your change in the Security log. Event ID 4719.

So I went and disabled/enabled a scheduled task. Now I can see these logs.

We use System Center Operations Manager. So at this point I could capture on the various event IDs (also in the link above) that this new audit log will generate.

Hopefully this will shortcut the process for you. As you can see, I had to pull together a few resources to understand what I really needed.

Video Documentation FTW

I highly recommend anyone doing any type of technical documentation look at Camtasia Studio from TechSmith (or something like it). Crazy easy to use. We tried free solutions like CamStudio to start which was a good proof of concept. However, Camtasia blew it out of the water. This solution was an absolute documentation gold mine for our IT department. We are able to knock out thourough tutorials in minutes not hours. We never miss a step, screen shot, or otherwise. Heck, I documented a Great Plains SQL backup, server Windows Updates, DNS Scavenging, temp profile corruption for 2008 R2, and Exchange mailbox migrations. That was just this afternoon, not even joking. When was the last time you documented 5 systems in a day, much less a month?

My favorite use case so far is the dreaded vendor support call. I can be on the line with Microsoft for an hour and a half and record the whole thing. I just did troubleshooting for DNS aging and scavenging. 100 minutes of footage trimmed down to 6 minutes of reusable documentation. I'll keep the rest of the video for future reference.

Another good example was the reverse. I wanted to show the vendor what I did. I was installing VMware ESXi 4.1 and ran into a snag with HP iLO mounting virtual media to install without having to drive to the data center (sounds simple right?). It worked on other servers just not this one. I recorded basically BIOS level troubleshooting for 3 hours. Later when I contacted VMware for support they said "what's the error?" "oh, let me fast forward to that". No rehashing what I had already done. "what's the bios version" "let's go back to the first 30 minutes". Long story short, turns out incompatible blah blah don't use an ISO so I went for a ride. One of the easiest support calls ever.

It's so simple it's genius. Yet we've been making Word docs with screenshots for years. Never again I say! We've almost converted our entire library of documentation into video screen casts (HD of course), being sure not to leave out relevant title pages for intro info and captions for the "why" behind the steps.

It's no exaggeration to say I have our entire department literally giddy about doing documentation. I keep hearing "How many videos did you to today?" It's a few hundred for an application but you'll NEVER regret it.

-Shep