7 Appendix B: Product Behavior

The information in this specification is applicable to the following Microsoft products or supplemental software. References to product versions include updates to those products.

The terms "earlier" and "later", when used with a product version, refer to either all preceding versions or all subsequent versions, respectively. The term "through" refers to the inclusive range of versions. Applicable Microsoft products are listed chronologically in this section.

Windows Client

• Windows NT Workstation 4.0 operating system with Service Pack 2 (SP2)

• Windows 2000 Professional operating system

• Windows XP operating system

• Windows Vista operating system

• Windows 7 operating system

• Windows 8 operating system

• Windows 8.1 operating system

• Windows 10 operating system

• Windows 11 operating system

Windows Server

• Windows 2000 Server operating system

• Windows Server 2003 operating system

• Windows Server 2008 operating system

• Windows Server 2008 R2 operating system

• Windows Server 2012 operating system

• Windows Server 2012 R2 operating system

• Windows Server 2016 operating system

• Windows Server operating system

• Windows Server 2019 operating system

• Windows Server 2022 operating system

• Windows Server 2025 operating system

Exceptions, if any, are noted in this section. If an update version, service pack or Knowledge Base (KB) number appears with a product name, the behavior changed in that update. The new behavior also applies to subsequent updates unless otherwise specified. If a product edition appears with the product version, behavior is different in that product edition.

Unless otherwise specified, any statement of optional behavior in this specification that is prescribed using the terms "SHOULD" or "SHOULD NOT" implies product behavior in accordance with the SHOULD or SHOULD NOT prescription. Unless otherwise specified, the term "MAY" implies that the product does not follow the prescription.

<1> Section 1.3:  The SASec interface was introduced in the Windows 2000 operating system and the ITaskSchedulerService interface made its debut in Windows Vista.

<2> Section 1.3: Windows clients use the server message block (SMB) remote file-system protocol [MS-SMB].

<3> Section 1.8: Windows applications do not set the C bit.

<4> Section 2.1: All Windows clients specify "Simple and Protected GSS-API Negotiation".

<5> Section 2.3.4: The Microsoft implementations use a scalar DWORD_PTR, as specified in [MS-DTYP] section 2.2.10. This is treated as a DWORD value when present on the wire.

<6> Section 2.3.4: The Windows implementation returns 0x00000057.

<7> Section 2.3.4: The Windows implementation returns 0x00000057.

<8> Section 2.3.4: The Windows implementation returns 0x00000057.

<9> Section 2.3.8: In Microsoft implementations, this protocol supports any authentication supported by the underlying operating system. For more information on authentication in Windows, see [MS-AUTHSOD].

<10> Section 2.3.14: Windows returns failure codes to invoking applications uninterpreted. In addition to the error codes, as specified in [MS-ERREF], the Windows Task Scheduler server also uses the following HRESULT error codes:

<11> Section 2.4.1: Windows clients write the following values:

<12> Section 2.4.1: The Windows implementation requires the status field to be initially set consistent to the Trigger Count field.

<13> Section 2.4.2.3: In Windows NT 4.0 operating system Service Pack 2 (SP2), Windows NT Workstation 4.0 operating system with Service Pack 3 (SP3), Windows NT Workstation 4.0 operating system with Service Pack 4 (SP4), Windows NT Workstation 4.0 operating system with Service Pack 5 (SP5), Windows NT Workstation 4.0 operating system with Service Pack 6 (SP6), Windows NT Workstation 4.0 operating system Service Pack 6a (SP6a), Windows 2000, Windows XP, and Windows Server 2003, the AN bit of the task flags field (see Flags (section 2.3.7)) is set to 1 if an application name is specified in the .JOB file (that is, if the Application Name field is nonempty).

<14> Section 2.4.2.9: In Windows Vista and later and Windows Server 2008 and later, the SASetAccountInformation implementation returns 0x8007000D. This is the HRESULT form of the Win32 error ERROR_INVALID_DATA, and occurs when the Reserved Data Size is nonzero and is not 8 (see SASetAccountInformation (section 3.2.5.3.4)). In Windows XP and Windows Server 2003, the SASetAccountInformation implementation returns S_OK, but the scheduling engine does not load the task.

<15> Section 2.4.2.9: In Windows Vista and later and Windows Server 2008 and later, the Start Error information is passed through the task exit code field, and it can only be modified when explicitly using the v1 API to run the task.

<16> Section 2.4.2.11: In Windows Vista and later, the SASetAccountInformation (section 3.2.5.3.4) implementation will return error code 0x80041318.

In Windows Server 2008 and later, the SASetAccountInformation (section 3.2.5.3.4) implementation will return SCHED_E_MISSINGNODE (0x80041319) when Begin Year is in the range 1000 to 1600.

In Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003, the SASetAccountInformation implementation will return S_OK, but the scheduler engine will not load the .JOB definition file with the incorrect date set.

Windows Vista and later and Windows Server 2008 and later will accept task trigger years in the range of 1601 to 9999.

<17> Section 2.4.2.11: In Windows Vista and later and Windows Server 2008 and later, the SASetAccountInformation (section 3.2.5.3.4) implementation will return error code 0x80041318.

In Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003, the SASetAccountInformation implementation will return S_OK, but the scheduler engine will not load the .JOB definition file with the incorrect date set.

<18> Section 2.4.2.11: Refer to the product behavior note for the Begin Month field.

<19> Section 2.4.2.11: Refer to the product behavior note for the Begin Month field. Windows Vista and later and Windows Server 2008 and later accept task trigger years in the range of 1601 to 9999.

<20> Section 2.4.2.11: Refer to the product behavior note for the Begin Month field.

<21> Section 2.4.2.11: Refer to the product behavior note for the Begin Month field.

<22> Section 2.4.2.11: Windows Vista and later and Windows Server 2008 and later SASetAccountInformation implementations will return SCHED_E_INVALIDVALUE, if the repetition interval is greater than 31 days, or the interval is nonzero and greater than or equal to the minutes duration value.

<23> Section 2.4.2.11: Windows Vista and later and Windows Server 2008 and later SASetAccountInformation implementations will return SCHED_E_INVALIDVALUE, if the repetition interval is greater than 31 days, or the interval is nonzero and greater than or equal to the minutes duration value.

<24> Section 2.4.2.12: In Windows, a certificate in the user's certificate store with signature key usage capability is located, and the private key associated with that certificate is extracted. For more information, see [MS-CIFS] section 2.2.3.1. See also [MS-WCCE].

<25> Section 2.5.3.8: The ATSvc on Windows has the ability to start and track multiple terminal server sessions. If a user has multiple active sessions, each task for the specific user will be activated in all the user's sessions, whether connected or disconnected.

<26> Section 2.5.3.8: In Windows Vista and later and Windows Server 2008 and later, the "Switch User" option facilitates the switch from an old user session to a new user session.

<27> Section 2.5.4.9: For more information about network awareness in Windows, see [MSDN-NetAware].

<28> Section 2.5.4.14: Windows scheduling engine server implementations use the following defaults. IdleSettings node: Duration – 0, WaitTimeout – 0xFFFFFFFF, StopOnIdleEnd – FALSE, RestartOnIdle – FALSE. The client-side API, while generating task definition XML, will still use the defaults specified in the schema.

<29> Section 2.5.4.14: Windows scheduling engine server implementations use the following defaults. IdleSettings node: Duration – 0, WaitTimeout – 0xFFFFFFFF, StopOnIdleEnd – FALSE, RestartOnIdle – FALSE. The client-side API, while generating task definition XML, will still use the defaults specified in the schema.

<30> Section 2.5.4.14: Windows scheduling engine server implementations use the following defaults. IdleSettings node: Duration – 0, WaitTimeout – 0xFFFFFFFF, StopOnIdleEnd – FALSE, RestartOnIdle – FALSE. The client-side API, while generating task definition XML, will still use the defaults specified in the schema.

<31> Section 2.5.4.14: Windows scheduling engine server implementations use the following defaults. IdleSettings node: Duration – 0, WaitTimeout – 0xFFFFFFFF, StopOnIdleEnd – FALSE, RestartOnIdle – FALSE. The client-side API, while generating task definition XML, will still use the defaults specified in the schema.

<32> Section 2.5.7.2: The custom handler uses the Task Scheduler Remoting Protocol Component Object Model (COM) interfaces. For more information, see [MSDN-TaskSch].

<33> Section 2.5.7.2: Windows Vista and later and Windows Server 2008 and later implementations allow only out of process activation of COM–based tasks. Implementation of ITaskHandler is able to be created with CLSCTX_LOCAL_SERVER context.

<34> Section 2.5.7.3: Email Action is available in Windows NT Workstation 4.0 SP2, Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, and Windows Server 2012 only.

<35> Section 2.5.7.4: ShowMessage Action is available in Windows NT Workstation 4.0 SP2, Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, and Windows Server 2012 only.

<36> Section 3.1: Typically the choice of interface is made by the application. For example, some applications use the ATSvc interface and work with all server versions, and some applications use the ITaskSchedulerService interface and only work with Windows Server 2008 servers.

<37> Section 3.1.4.2: Windows clients use the SMB remote file-system protocol [MS-SMB].

<38> Section 3.1.4.2.1.1: The job store location can be found as the TasksFolder value under the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SchedulingAgent key. If the TasksFolder value has the type REG_SZ, the client is required to use the value directly. If the value has the type REG_EXPAND_SZ, the client expands the value as specified in the following paragraph. If the value has any other type, the client reports an error to the application.

To expand a REG_EXPAND_SZ TasksFolder value, the client parses the value looking for "%SystemRoot%" substrings. For each such substring, the client substitutes the remote SystemRoot value. If the TasksFolder value contains any other use of the "%" character, the client operation reports an error to the application.

To obtain the remote SystemRoot value, the client uses the remote registry protocol as specified in [MS-RRP] section 3.1.5, by retrieving the SystemRoot value under the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion key. If the value has any type other than REG_SZ, the client reports an error to the application.

<39> Section 3.1.4.2.2: Windows clients create and write the file as specified in sections [MS-CIFS] 2.2.4.64 and 2.2.4.43.

<40> Section 3.1.4.2.3: Windows clients delete the file using SMB as specified in [MS-CIFS] section 2.2.4.7.

<41> Section 3.1.4.2.4: Windows clients write the file as specified in [MS-CIFS] section 2.2.4.43.

<42> Section 3.1.4.2.5: Windows clients read the file using SMB as specified in [MS-CIFS] section 2.2.4.42.

<43> Section 3.1.4.2.6: Windows clients enumerate and read the files by using SMB as specified in [MS-CIFS] sections 2.2.6.2 and 2.2.4.42.

<44> Section 3.2: Windows NT 4.0 implements the ATSvc interface; Windows 2000, Windows XP, and Windows Server 2003 implement the ATSvc and SASec interfaces; Windows Vista implements the ATSvc, SASec, and ITaskSchedulerService interfaces.

<45> Section 3.2.1: Windows Vista and later and Windows Server 2008 and later implementations use an XML task store and a .JOB task store. ATSvc tasks are represented as .JOB files in the .JOB task store. All tasks in the .JOB task store are also represented in the XML task store. Similarly, the Windows 2000, Windows XP, and Windows Server 2003 implementations use a .JOB task store to represent ATSvc and SASec tasks. The Windows NT 4.0 implementation uses the registry [MS-RRP] to represent ATSvc tasks.

<46> Section 3.2.1: In Windows, this location is in the TasksFolder value under the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SchedulingAgent key. The TasksFolder value is required to have the REG_SZ or REG_EXPAND_SZ type. If the TasksFolder value has the REG_EXPAND_SZ type, then the value can only use the SystemRoot environment variable.

<47> Section 3.2.4.2: The Windows implementation checks the following states to decide if the machine is idle:

Or:

The idle detection period is 14.5 minutes.

<48> Section 3.2.5.1.1: Windows uses the CredMan component to store credentials locally. For more information, please see [MSDN-CREDMGMT].

<49> Section 3.2.5.1.1: The LogonType property of the task that is set to run in group context is ignored at registration time and the task will always run interactively.

<50> Section 3.2.5.1.1: The Windows implementation of the SchRpc protocol will accept RPC connections over TCP from local administrators only. RPC over LRPC does not have this limitation, but that is only for the local task scheduler and not the remote scheduler.

<51> Section 3.2.5.3: Windows clients use the SMB remote file system protocol [MS-SMB]. The Windows file system provides notifications. For more information, see [MSDN-ODCN].

<52> Section 3.2.5.3.4: Windows Server 2008 and later return SCHED_E_INVALIDVALUE when the Unused bit in Day of Month (section 2.4.2.11.2) is set to 1.

<53> Section 3.2.5.3.4: On Windows XP and Windows Server 2003, when the Application Name (section 2.4.2.3) field is provided with a non-null-terminated string or the string length provided is zero (section 2.4.2.1), the server returns 0x8004130e. If a non-null–terminated string is provided as input to the Parameters (section 2.4.2.4), Working Directory (section 2.4.2.5), Author (section 2.4.2.6), or Comment (section 2.4.2.7) fields, the server returns S_OK but does not load the task.

On Windows XP and Windows Server 2003, when the Start Hour field or the Start Minute field that is provided is out of range, the server returns S_OK but does not load the task. On Windows Vista and later and Windows Server 2008 and later, when the Start Hour field or the Start Minute field that is provided is out of range, the server returns 0x80041318.

Windows ignores the trigger offset value upon receipt.

On Windows Vista and Windows Server 2008, if the File Version field is not set to 0x0001, the server returns 0x80041313. On Windows XP and Windows Server 2003, if the File Version field is not set to 0x0001, the server returns S_OK but does not load the task.

On Windows Server 2003 and later and Windows Vista and later, if the Trigger type is not specified as in Trigger Type (section 2.4.2.11.1), the server returns SCHED_E_UNEXPECTEDNODE (0x80041316). On Windows NT 4.0 SP2, Windows NT Workstation 4.0 SP3, Windows NT Workstation 4.0 SP4, Windows NT Workstation 4.0 SP5, Windows NT Workstation 4.0 SP6, Windows NT Workstation 4.0 SP6a, Windows 2000, Windows XP, and Windows Server 2003, the server does not load the job but returns S_OK.

Windows XP and Windows Server 2003 ignore the application name offset field. Windows Vista and later and Windows Server 2016 and later return SCHED_E_INVALID_TASK if the application name could not be read from the offset field or if the string read from the offset is not null terminated. Windows Vista and later and Windows Server 2008 and later return E_UNEXPECTED if the string at the application name offset is longer than 261 characters.

<54> Section 3.2.5.3.4: Windows Vista and later and Windows Server 2008 and later return SCHED_E_MISSINGNODE if the trigger type (see Trigger Type (section 2.4.2.11.1)) is MONTHLYDOW and the week is out of range.

<55> Section 3.2.5.3.4:  Windows Vista and later and Windows Server 2008 and later return the value 0x8007052E, the HRESULT form of the Win32 error ERROR_LOGON_FAILURE, if the pwszPassword parameter is not valid for pwszAccount.

<56> Section 3.2.5.3.4: Windows Vista bypasses the TASK_FLAGRUN_ONLY_IF_LOGGED_ON bit flag check in dwJobFlags.

<57> Section 3.2.5.3.4: Windows Vista and later and Windows Server 2008 and later additionally enforce the security checks described in Task Registration Security Checks (section 3.2.5.1.1).

<58> Section 3.2.5.3.4: The server returns 0x8007052E, the HRESULT form of ERROR_LOGON_FAILURE on Windows Vista and later and Windows Server 2008 and later.

<59> Section 3.2.5.3.4: Windows XP and Windows Server 2003 return S_OK if the MinutesInterval field is set to a value larger than the MinutesDuration field but set only the MinutesInterval value and ignore the MinutesDuration value.

<60> Section 3.2.5.3.4: On Windows XP and Windows Server 2003, return S_OK if Trigger type is not as specified in 2.4.2.11.1.

<61> Section 3.2.5.3.5: Windows Vista and later and Windows Server 2008 and later store "LocalSystem" in the ATSvc account name conceptual data structure and return S_OK when pwszAccount is empty string.

<62> Section 3.2.5.3.5: Windows Vista and later and Windows Server 2008 and later return E_INVALIDARG if the pwszPassword parameter is NULL.

<63> Section 3.2.5.3.5: Windows Vista and later and Windows Server 2008 and later return the value 0x0000052E, which is the HRESULT form of the Win32 error ERROR_LOGON_FAILURE, if the pwszPassword parameter is not valid for pwszAccount.

<64> Section 3.2.5.4: The ITaskSchedulerService interface is present in Windows Vista and Windows Server 2008.

<65> Section 3.2.5.4.1: Windows Vista and Windows Server 2008 return version 1.2, and Windows Server 2008 R2 and later and Windows 7 and later return version 1.3.

<66> Section 3.2.5.4.2: Windows Server 2008 and later and Windows 10 and later return E_INVALIDARG (0x80070057) when an undefined bit is set to 1.

<67> Section 3.2.5.4.2: The ATSvc on Windows has the ability to start and track multiple terminal server sessions. If a user has multiple active sessions, each task for the specific user will be activated in all the user's sessions, whether connected or disconnected.

<68> Section 3.2.5.4.2: The ATSvc on Windows has the ability to start and track multiple terminal server sessions. If a user has multiple active sessions, each task for the specific user will be activated in all the user's sessions, whether connected or disconnected.

<69> Section 3.2.5.4.2: For more information about network awareness in Windows, see [MSDN-NetAware].

<70> Section 3.2.5.4.4: Windows Vista and later and Windows Server 2008 and later bypass the NTFS security checks when the client connects with Local Administrator privileges from an elevated mode console.

<71> Section 3.2.5.4.7: Windows implementations limit the total space required to return the subfolder names to 64 kilobytes.

<72> Section 3.2.5.4.8: Windows implementations limit the total space required to return the subfolder names to 64 kilobytes.

<73> Section 3.2.5.4.9: Windows Vista and Windows Server 2008 return S_OK, if the task specified in the path parameter does not exist on the server or the file specified by the path parameter does not exist in the XML task store.

<74> Section 3.2.5.4.12: Windows Vista and Windows Server 2008 return S_OK if the task does not exist.

<75> Section 3.2.5.4.12: Windows 7 and later and Windows Server 2008 R2 operating system and later allow stopping of hidden tasks.

<76> Section 3.2.5.4.14: Windows 7 and later and Windows Server 2008 R2 and later return E_ACCESSDENIED when the path is the root.

<77> Section 3.2.5.4.14: Windows 7 and later and Windows Server 2008 R2 and later return S_OK for the first SchRpcDelete call if the task was already deleted by setting the DeleteExpiredTaskAfter attribute.

<78> Section 3.2.5.4.14: Windows Vista and Windows Server 2008 return ERROR_PATH_NOT_FOUND, if the task specified in the path parameter does not exist on the server or the file specified by the path parameter does not exist in the XML task store.

<79> Section 3.2.5.4.14: Windows Vista and later and Windows Server 2008 and later bypass the NTFS security checks when the client connected from an elevated mode console with Local Administrator privileges.

<80> Section 3.2.5.4.16: Windows implementations limit the total space required to return the subfolder names to 64 kilobytes.

<81> Section 3.2.5.4.19: The SchRpcGetNumberOfMissedRuns method is not implemented on the server side and will return S_OK and 0 in the pNumberOfMissedRuns parameter.

<82> Section 5.1: Windows uses the flags PKT_PRIVACY and RPC_C_AUTHN_WINNT (or RPC_C_AUTHN_GSS_NEGOTIATE if available) as in a Kerberos domain, as specified in [MS-RPCE] section 2.2.1.1.8.