1
I'm trying to trigger a scheduled task with this XML:
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">
*[EventData[Data[@Name='TargetInfo']='S']]
</Select>
</Query>
</QueryList>
That query works fine if I use it to filter events in the Event Viewer, but is never triggered when used in a scheduled task.
The task runs if I invoke it manually in the Task Scheduler.
I've tried running the task as SYSTEM
, NT AUTHORITY\LOCAL SERVICE
and as a local user.
I am able to successfully use other queries, like *[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID=4648)]]
.
I've also tried the alternative syntax *[EventData[Data[@Name='TargetInfo'] and (Data='S')]]
.
What am I doing wrong? Thanks.