VBScript to list Scheduled Tasks and Find Resources

[djtech2k]

Now before anyone thinks I did not research, please hear me out.

I need to write something that will scan a list of machines and see if a particular account is being used to run resources, like services, scheduled jobs, etc.

I think I have the part complete to check services. My problem is now with tasks. I know that win32_scheduledjobs scans the "AT" tasks but it seem that anything scheduled in the windows GUI will NOT be displayed in that class. Any ideas how I can get this info? Am I missing any other resources to check as well? This is a service account that needs to go away.

I know schtasks is a command tool, but I cannot filter it to show just the ones for this svc account.

Thanks in advance.

 

[kmcferrin]

Interesting. I did some digging and this was the best that I could come up with:

http://groups.google.com/group/micr...ccb9c8171c2/bd166d42bf4d4be2#bd166d42bf4d4be2

 

[djtech2k]

Thats kinda funny because thats kinda what I am doing until I find something better. I am grabbing the c:\windows\tasks dir and enumerating all .job filenames in that dir. The problem is that I need to identify the username running the tasks, not just the names. Also, on DC's theres a bunch of job files that are not actually tasks. I guess its some kind of internal job creation of sorts.

So as of now, the best I can do is to read the .job filenames.

 

[kmcferrin]

If you scroll down in that thread, there was the suggestion to have the script run SCHTASKS.EXE, capture the output, and then parse that output for the data they were looking for. But that only works on WIndows XP/2003 or later.

This looks like a serious deficiency on Microsoft's part.

 

[djtech2k]

FYI, here is a snippet that I am using right now. This is the part of using schtasks and then parsing the output. Unfortunately, I am having to to write it to text and then parse rather than doing it in memory. This section is inside of a big loop that reads a file of servernames.

sExe = "schtasks /query /s " & strComputer & " /v /fo list"

Set oShell = CreateObject("WScript.Shell")
Set oFSO = CreateObject("Scripting.FileSystemObject")

oShell.Run "%comspec% /c " & sExe & " >c:\test.txt", 0, True
wscript.sleep 10000

Set fFile = oFSO.OpenTextFile("c:\test.txt", ForReading, FailIfNotExist, OpenAsASCII)
sResult = fFile.ReadAll
arrValues = Split(sResult, vbcrlf)
For Each Line In arrValues
arrValue3 = Split(arrValues(2), ":")
arrValue2 = Split(arrValues(19), ":")
If arrValue2(1) = strServiceAcct Then
objFile2.WriteLine "TASKS Scheduled By: " & strServiceAcct & " on " &  strComputer & vbcrlf
objFile2.WriteLine Replace(arrValue3(1), " ", "") & ";" & Replace(arrValue2(1), " ", "") & vbcrlf
End If

next
fFile.Close
Loop