Scheduled Tasks

We can use the schtasks command to enumerate scheduled tasks on the system

schtasks /query /fo LIST /v
# or in powershell
Get-ScheduledTask | select TaskName,State

By default we can only see tasks created by our user and default scheduled tasks. Scheduled tasks created by admins are stored in C:\Windows\System32\Tasks which standard users do not have access to. A scheduled tasks that runs as an administrator may be configured with weak file/folder permissions.

.\accesschk64.exe /accepteula -s -d C:\Scripts\

Related

• user-interaction
• Other Privesc
• windows-old
• Enumerating Security Controls