Event ID 4699
A scheduled task was deletedA scheduled task was deleted.
Subject:
Security ID: %1
Account Name: %2
Account Domain: %3
Logon ID: %4
Task Information:
Task Name: %5
Task Content: %6
Auditing:
Always
Monitor all scheduled task deletion events, especially on critical computers or devices.
Volume:
Low
PCI 3.2.1: 10.2.7
Microsoft Documentation
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Other Object Access Events"
LEFT/RIGHT arrow keys for navigation
Back to List