Log Dejargonizer

Windows Security Log · Event 4699

Event 4699: A scheduled task was deleted

A scheduled task was removed. Usually software being uninstalled. The pattern worth hunting is a task created and deleted within a short window, which is what an attacker does when the task has served its purpose.

Also written as Event ID 4699A scheduled task was deleted4699 scheduled task

What it means for you

For an analyst

Correlate against 4698. A create followed by a delete inside a day is cleanup after use.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
A scheduled task was deleted.

Subject:
  Security ID:    CORP\jbrooks
  Account Name:   jbrooks
  Account Domain: CORP
  Logon ID:       0x3E9A11

Task Information:
  Task Name: \Microsoft\Windows\UpdateOrchestrator\Refresh

The fields that decide it

Everything else in the log line is context.

TaskName
The task's path and name.
TaskContent
The task definition. Not always populated on deletion.
SubjectUserName
Who deleted it.
SubjectLogonId
The session responsible. Join to the 4624 for the source address.

Ordinary reasons this happens

Most of the time it is one of these.

  • Software being uninstalled or updated.
  • Windows maintenance tasks being reconfigured.
  • Management tooling adjusting schedules.
  • Administrators tidying up tasks nobody needs.

When it is not ordinary

Removing a task after it has served its purpose.

What gives it awayA deletion shortly after the matching 4698 creation, by the same session.

ATT&CK T1070

Covering tracks after persistence was used.

What gives it awayTask deletions clustered with other cleanup, such as file deletions and log clearing.

ATT&CK T1070

What to do next

  1. Look for the matching 4698 creation. Create and delete inside a day is the pattern.
  2. Check whether a software install or uninstall was happening at that time.
  3. Confirm the person responsible administers that machine.
  4. Check whether other tasks changed in the same window.
  5. Compare against the task set on a known-good machine of the same build.

Queries to run

kql 
SecurityEvent | where EventID == 4699 | project TimeGenerated, Computer, SubjectUserName, RenderedDescription | order by TimeGenerated desc
kql Tasks created and removed within a day. Legitimate software rarely does this. 
let created = SecurityEvent | where EventID == 4698 | project CreateTime = TimeGenerated, Computer, Task = tostring(extract(@'Task Name:\s*(\S+)', 1, RenderedDescription));
let gone = SecurityEvent | where EventID == 4699 | project GoneTime = TimeGenerated, Computer, Task = tostring(extract(@'Task Name:\s*(\S+)', 1, RenderedDescription));
created | join kind=inner gone on Computer, Task | where GoneTime - CreateTime < 24h

Common questions

Why would an attacker delete their own scheduled task?

Because once the payload has run or a more durable foothold exists, the task is only evidence. Creating and deleting a task within a short window is a recognisable pattern, and the deletion is often the event that survives when the creation was missed.

Do these events need auditing enabled?

Yes — the Audit Other Object Access Events subcategory, the same one Event 4698 needs. Enable it once and you get create, update, and delete together, which is the only way the pattern-based detections work.

Read next

Vendor documentation

Last reviewed 28 August 2026