A little while ago I was demonstrating some of the functionalities of the Windows Event Viewer. It has been around for so many years, and yet there are people who have not used it. One of the functions that I demonstrated was attaching a task to an event… so when a particular event happens, a script is run.
Adding the task is easy… you click on the event in question, and then in the Actions pane you click Attack Task To This Event… just like this:
The options for the task will come up… you can either start a program, send an e-mail, or display a message (although the last two options are deprecated). In other words, you are running a program… or a script.
Attaching a task is easy… but if you want to remove that task… well, that’s another story. There is simply no option to do it.
Event Viewer is a good ‘free’ tool. If you are using it for your environment, then you are likely either an individual or a very small organization. Even a respectable-sized small business would have more advanced tools for their server monitoring and management. As such, I am not sure if they have made any real modifications to it since Windows Vista/Server 2008. All this to say that there is no ‘detach’ or ‘remove task’ option anywhere in the window.
There is, however, a way to remove them. Here’s how:
- On the server (or desktop) in question, navigate to “C:\Windows\System32\Tasks\Event Viewer Tasks”.
- Find the task in question.
- Delete the task.
These files, which have no file extension, are nonetheless XML files. You can open them up and modify them if you want without doing any real damage… but most of the time it would be just as easy to delete it and start from scratch.
Deleting the file shouldn’t have any negative consequences for your system, but if you are concerned, you can back it up by simply copying the file to an alternate file location.
I hope this helped!