Title
#general
e

ET

12/30/2020, 11:19 AM
Hi there There is way to join between scheduled_tasks to username or user_id ?
SK

SK

12/30/2020, 11:33 AM
Hello @ET I don't think there is a direct way to join this to a username or user_id, the direct connections I could find were these, maybe it can help you on your way. Each line is a possible join.
autoexec.name, scheduled_tasks.name
autoexec.name, programs.name, registry.name, scheduled_tasks.name
autoexec.name, registry.name, scheduled_tasks.name
autoexec.name, logon_sessions.logon_type, scheduled_tasks.name
autoexec.name, interface_addresses.friendly_name, interface_details.connection_id, scheduled_tasks.name
autoexec.name, scheduled_tasks.name, startup_items.name
autoexec.name, programs.name, scheduled_tasks.name
autoexec.path, scheduled_tasks.path
background_activities_moderator.last_execution_time, scheduled_tasks.last_run_time
e

ET

12/30/2020, 11:35 AM
Nice
11:35 AM
Do you know if can I get username from the following direct tables
SK

SK

12/30/2020, 11:54 AM
I'm not sure any of these tables will give you what you want, you want to know the author of the scheduled_task right?
11:56 AM
But you should be able to JOIN to the
background_activities_moderator
table and that table has SID (UserID) that should give you the user that the task is run under...
11:59 AM
Let me know if you get any results from that, curious to know if you get the desired data.
12:02 PM
BTW interesting to know you would think that the path in both tables can be used to JOIN but the way it is represented makes it not possible.
e

ET

12/30/2020, 1:51 PM
Great let me check - Thanks a lot !