Windows scheduled tasks extension
- Latest Dynatrace
- Extension
- Published Oct 27, 2025
Monitor your Windows scheduled tasks and alert on execution issues.
Get started
Overview
Monitor Windows scheduled tasks and receive alerts for execution issues.
This is a OneAgent extension running on Windows servers. Every minute, the extension interrogates the system for details about your configured scheduled tasks and sends Dynatrace the current state each task is in along with the time that passed since their last executions.
A problem is created automatically for any task which registered an operational failure (failed to launch, execute, or complete). Additionally, problems can also be enabled for tasks which are taking longer than expected to complete or ones which have missed their expected scheduled execution.
Use cases
- Track the state of scheduled tasks
- Alert on failed executions, hanging tasks, and missed runs
Compatibility information
- Microsoft Windows 2012 R12 and newer.
- Minimum OneAgent version 1.275.0
Activation and setup
Setup on a Windows host
- Enable Windows Event Log for querying
- Windows Event Logs are enabled for programmatic querying through registry keys
- On the target system, create a key called
Microsoft-Windows-TaskScheduler/Operationalin the registry at locationComputer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog⚠️NOTE: The name of the key (folder) must be Microsoft-Windows-TaskScheduler/Operational. It's not two nested folders (common mistake)
- Check permissions for task configuration files
- The extension reads task details directly from their configuration files. These are stored
relative to the base location of
C:\Windows\System32\Tasks - Ensure the files of all monitored tasks are readable by the
LOCAL_SERVICEuser account
- The extension reads task details directly from their configuration files. These are stored
relative to the base location of
Extension configuration
First, add the extension to your environment, then create a monitoring configuration.
After selecting a scope for the configuration, you must provide details about which tasks you want to monitor and to what level.
In the Scheduled Tasks Configuration section:
- Ingest events - when enabled, all Task Scheduler events (from the Windows Event Log) used by the extension will also be ingested in Dynatrace.
- Allow merging events - When enabled, common alerting events are merged into existing problems. Otherwise, new problems are created every time.
- Allow frequent issue detection - When enabled, repeating error events may be suppressed from alerting and labelled as Frequent Issues.
- Suppress alerts by event ID - Allows you to enter windows event IDs (separated by semicolon) which should not open Problems when detected.
In the Tasks to monitor section:
- Click the Add item button to add each of the tasks you want to monitor.
- For each task configure:
- Task name - this must match the name of the task as it appears in Task Scheduler.
- Task path - this is the folder path within the Task Scheduler. Leave "\" if your tasks are in the base folder, otherwise add the path to the task's folder.
- Auto-detect timeout - When enabled, the extension will read the task's configured timeout from its configuration file and set up alerting based on this value. Disabling this setting allows you to specify a manual value for alerting. Alerting for timeouts will be disabled if no value is provided.
- Auto-detect execution frequency - When enabled, the extension will read the task's configured frequency from its configuration file and set up alerting based on this value. Disabling this setting allows you to specify a manual value for alerting. Alerting for missed executions will be disabled if no value is provided.
For Dynatrace Managed
For logs to show up correctly on the screens of Scheduled Task entities, the Logs Classic engine requires the attribute dt.entity.win:scheduled_task to be registered in advance. To do this:
- Go to Settings > Log Monitoring > Custom attributes
- Select Add custom attribute
- Enter the key
dt.entity.win:scheduled_task(optionally, it can also be enabled for the side bar)
Details
By default, the extension produces two metrics:
- Task state - can be used to understand which state each task is in
- Time since last execution - tracks how long has passed since a task last ran
You can find these by navigating to Metrics, then filtering by the tag ScheduledTasks.
In addition, with the Ingest events option, the extension will also produce log records. These
can be found in the log viewer by filtering for
log.source == "Microsoft-Windows-TaskScheduler/Operational"
Feature sets
When activating your extension using monitoring configuration, you can limit monitoring to one of the feature sets. To work properly the extension has to collect at least one metric after the activation.
In highly segmented networks, feature sets can reflect the segments of your environment. Then, when you create a monitoring configuration, you can select a feature set and a corresponding ActiveGate group that can connect to this particular segment.
All metrics that aren't categorized into any feature set are considered to be the default and are always reported.
A metric inherits the feature set of a subgroup, which in turn inherits the feature set of a group. Also, the feature set defined on the metric level overrides the feature set defined on the subgroup level, which in turn overrides the feature set defined on the group level.
FAQ
Every Windows Event processed by the extension regarding a task will update the task's state. Whenever the task enters the Running state, a timestamp is kept for later reference. This timestamp is evaluated when alerting about timeouts and missed runs.
-
Task
TaskNameappears to be hanging:This is controlled by the "timeout" setting on each task which can be either auto-detected from the Scheduler's configuration, overridden with a manual value, or disabled if the value is set to 0.
Every minute in which the task is still in Running state, the extension calculates how long has passed since the task entered the Running state. If the value exceeds the timeout value, a problem is raised.
-
Task
TaskNamedid not run on time:This is controlled by the "execution frequency" setting on each task which can be either auto-detected from the Scheduler's configuration, overridden with a manual value, or disabled if the value is set to 0.
Every minute, the extension calculates how long has passed since the task last entered a Running state. If the value exceeds the expected frequency value, the task is assumed to have missed its scheduled run and a problem is raised.
In addition to the timeouts and missed runs mentioned above, the extension will also automatically open a problem with one of these titles whenever any of the listed events are recorded for the scheduled task:
- Task failed to start:
- 101 (Failed to start the task)
- 103 (Failed to start the instance of the task)
- 104 (Logon failure)
- 112 (Network unavailable)
- 130 (Service is busy)
- 203 (Unknown/generic error)
- 204 (Could not retrieve trigger events)
- 205 (Trigger event pattern failed to match)
- 305 (Unknown/generic error)
- 322 (Another instance already running)
- 326 (PC running on batteries)
- 332 (User not logged in)
- Task execution failed:
- Task failed to complete:
Events can be ignored from alerting by using the Suppress alerts by event ID configuration parameter introduced in version 3.2.9.
Whenever a monitoring configuration is created or updated, all tasks are created with the default state Unknown until the monitoring receives any event about the task to change its state.
If your tasks remain in Unknown state despite other events happening, it may indicate there is an issue with reading Windows Event Logs. Check that the Windows host has been correctly configured.
There are two PowerShell commands that can be used for this.
-
The following command shows all Windows Event Logs enabled for reading:
get-eventlog -ListEnsure that
Microsoft-Windows-TaskScheduler/Operationalis part of the list and the second to last column (entries available) is greater than zero. -
The following command fetches most recent 10 events from the task scheduler log:
gwmi -query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='Microsoft-Windows-TaskScheduler/Operational' | select -first 10Ensure that items are returned. If the output of the command is empty, the data required by the extension is either not produced or not enabled for programmatic reading.
