Skip to content

Check tasksched targeted task discovery#389

Merged
sni merged 18 commits into
mainfrom
check-tasksched-targeted-task-discovery
Jun 18, 2026
Merged

Check tasksched targeted task discovery#389
sni merged 18 commits into
mainfrom
check-tasksched-targeted-task-discovery

Conversation

@inqrphl

@inqrphl inqrphl commented Jun 15, 2026

Copy link
Copy Markdown
Contributor

Add arguments to the check_tasksched, and improve the embedded script for getting tasks

The script has two steps now, one is used for filtering the tasks using Get-ScheduledTask. This is crude in terms of detail but is fast, and serves to discover and possibly filter tasks at the same time:

title - adds the -TaskName [title] filter, it should be a direct match
folder - adds the -TaskPath [path] filter, it should be a direct match
recursive - appends a wildcard at the end of -TaskPath filter, so that subfolders are included as well.

Extended the powerShellCmd function to take parameters. Parameter definitions are prepended to the start of the command, and parameter specifications are placed after the command. This way, powershell parses these parameters.

The script accepts these parameters when called standalone as well, but these are done by manually parsing the $args variable. useful for testing the script directly.

After the discovery step, Get-ScheduledTaskInfo is called for all matching tasks. This is the more expensive step, but as it is done after discovery, users can speed things up by filtering early.

The script reports the Principal, Actions, Triggers and Settings nested objects from Get-ScheduledTaskInfo as well now. Script outputs these in JSON format as well, and snclient parses them into typed structs. Not all of the fields are added as an attribute to the check. They can be used later if necessary.

If no arguments are specified, title is set as '*', the folder is set as '' , and recursive discovery is on. This matches every scheduled task.

If after the filtering no tasks are discovered, the script returns an empty JSON array, snclient returns an empty output. This gives 'WARNING - No tasks found'

For the detail output, the task now displays the URI of each task. This prevents cases where different tasks are saved on different paths with the same name.

For the tasks that reside directly under the root, like '[TaskName]' clean up the URI by removing the backslash. This is not done if the task is saved under a folder. Use this cleaned up result when displaying the details.

Example outputs

PS C:\Users\sorus\repositories\snclient> .\snclient.windows.amd64.exe --logfile stdout run check_tasksched title="AMDAutoUpdate"
WARNING - AMDAutoUpdate (2026-06-08 00:00:01 CEST) exited with 3221225786
PS C:\Users\sorus\repositories\snclient> .\snclient.windows.amd64.exe --logfile stdout run check_tasksched title="UnavailableTask" show-all                                                        
UNKNOWN - No tasks found, check your arguments/filters/thresholds using title attribute.
PS C:\Users\sorus\repositories\snclient> .\snclient.windows.amd64.exe --logfile stdout run check_tasksched filter='title eq unavailable-task' show-all
UNKNOWN - No tasks found, check your arguments/filters/thresholds using title attribute.
PS C:\Users\sorus\repositories\snclient> .\snclient.windows.amd64.exe --logfile stdout run check_tasksched folder="\Microsoft\VisualStudio\" recursive="false" show-all
OK - \Microsoft\VisualStudio\VSIX Auto Update (2026-06-17 10:02:10 CEST) exited with 0
PS C:\Users\sorus\repositories\snclient> .\snclient.windows.amd64.exe --logfile stdout run check_tasksched folder="\Microsoft\VisualStudio\" recursive="true" show-all
OK - \Microsoft\VisualStudio\VSIX Auto Update (2026-06-17 10:02:10 CEST) exited with 0, \Microsoft\VisualStudio\Updates\BackgroundDownload (2026-06-17 13:18:19 CEST) exited with 0, \Microsoft\VisualStudio\Updates\UpdateConfiguration_S-1-5-21-311550486-2925901240-1737056545-1001 (2026-06-17 09:56:43 CEST) exited with 0
PS C:\Users\sorus\repositories\snclient> .\snclient.windows.amd64.exe --logfile stdout run check_tasksched folder="\Microsoft\VisualStudio\" recursive="false" show-all
OK - \Microsoft\VisualStudio\VSIX Auto Update (2026-06-17 10:02:10 CEST) exited with 0
PS C:\Users\sorus\repositories\snclient> .\snclient.windows.amd64.exe --logfile stdout run check_tasksched folder="\Microsoft\VisualStudio\" recursive="false" show-all
OK - All tasks are ok

inqrphl and others added 8 commits June 12, 2026 19:04
by default it is set as '*', but that is cosmetic. If it set to anything else, the embedded powershell script is called with title=[title] parameter

passing that title needs some weird workarounds due to way snclient runs powershell scripts

the powershell script is however normal, it just then looks for tasks that contain [title] as substring if title parameter is present

it uses Get-ScheduledTask -TaskName ('*' + $title + '*') cmdlet instead of bare Get-ScheduledTask which would iterate over all tasks

this speeds up the check if a task name is known.

I named it title, as it was being added to the entry as "title", can change that if needed
instead of appending the variable definition to the script at the last point, and then calling powerShellCmd(ctx,script) , implement that functionality into powerShellCmdAddVariableDefinition

this searches the point where the script definition starts, and then adds the variable definition. reusable and less confusing about what it does.
…into check-tasksched-targeted-task-discovery
the script now filters its task discovery step based on folder definitions, optionally with a wildcard at the end if recursive option is enabled

the scirpt now does not exit with returncode != 0 if it cant find any matching tasks.

the script now always outputs a valid json array, even if it finds no tasks, one task or multiple tasks. this prevents errors when parsing script output

the script now reports Principal, Trigger, Setting, and Action nested objects of a TaskInfo. this is parsed more in detail on the go side, but not everything is added to the entry.
…discovery' into check-tasksched-targeted-task-discovery
@inqrphl inqrphl marked this pull request as draft June 15, 2026 14:57
inqrphl and others added 5 commits June 16, 2026 10:41
powershellCmd now takes a variadic parameter argument, these get added to the commandline. instead of defining these variables in the command body, now they are properly passed as parameters to the script.

the command body is prepended with parameter definitions, and the powershell commandline is appended with parameter specifications
better than using the task name, which might be same.

uri behaves more like a fully qualified name
@inqrphl inqrphl marked this pull request as ready for review June 16, 2026 09:12
inqrphl and others added 3 commits June 17, 2026 13:19
…have only one leading backslash i.e saved at root

change the detail syntax, use uri_clean , include a formatted most_recent_run_time and print the exit code directly

change default empty state to unknown

for cases where user specifies title in filters, thresholds or directly in the arguent, change the empty result syntax and warn about title attribute usage
Comment thread pkg/snclient/embed/scripts/windows/scheduled_tasks.ps1
Comment thread pkg/snclient/check_tasksched_windows.go
Comment thread pkg/snclient/check_tasksched_windows.go Outdated
Comment thread pkg/snclient/snclient_windows.go
Comment thread pkg/snclient/check_tasksched.go
inqrphl and others added 2 commits June 18, 2026 15:29
checker for the custom specified Folder and title, prevents powershell explotations

check passed parameters for quoutes when building powershell command. with another single quoute, existing quoute can be escaped and custom commands can be run

print output if the exitcode is 0 in the returned error

properly add paramters, executed command, and working dir , was not being added before

comment out discovered but unused fields returned while discovering scheduled tasks. when needed, they can be uncommented and used.
@sni sni merged commit bc9c36a into main Jun 18, 2026
139 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants