Skip to content

Instantly share code, notes, and snippets.

@invokethreatguy
Forked from wdormann/privtasks.ps1
Created August 15, 2023 15:15
Show Gist options
  • Save invokethreatguy/498c18f1001cf722dc935b729a5d72b9 to your computer and use it in GitHub Desktop.
Save invokethreatguy/498c18f1001cf722dc935b729a5d72b9 to your computer and use it in GitHub Desktop.
List privileged scheduled tasks that don't come with Windows
$currentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
if (-Not $currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
Write-Warning "We don't have elevated privileges. The following results may not be complete."
}
schtasks /query /fo csv -v | ConvertFrom-Csv | ? {$_.Status -notlike "Disabled" -and $_.TaskName -notlike "\Microsoft\Windows\*" -and $_.TaskName -notlike "\Microsoft\Office\*" -and $_.TaskName -notlike "\Microsoft\XblGameSave\*" -and $_.TaskName -notlike "TaskName" -and ($_."Run As User" -like "*system" -or $_."Run As User" -like "Administrator*")} | fl taskname,"Comment","Task To Run","Run As User"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment