XPath event filter working in Event Viewer but not in Task Scheduler

1

I'm trying to trigger a scheduled task with this XML:

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
*[EventData[Data[@Name='TargetInfo']='S']]
    </Select>
  </Query>
</QueryList>

That query works fine if I use it to filter events in the Event Viewer, but is never triggered when used in a scheduled task.

The task runs if I invoke it manually in the Task Scheduler.

I've tried running the task as SYSTEM, NT AUTHORITY\LOCAL SERVICE and as a local user.

I am able to successfully use other queries, like *[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID=4648)]].

I've also tried the alternative syntax *[EventData[Data[@Name='TargetInfo'] and (Data='S')]].

What am I doing wrong? Thanks.

ZachB

Posted 2014-08-12T20:34:36.317

Reputation: 121

No answers