Improvement: automate creation and registration of scheduled task

[fatso83]

SuperUser question

https://superuser.com/questions/1488344/create-a-scheduled-task-to-trigger-on-a-log-event-with-a-specific-event-id

Create a task in powershell

See https://devblogs.microsoft.com/scripting/use-powershell-to-create-scheduled-tasks/ for an example of using PowerShell to create a task.

Register a scheduled task example

https://docs.microsoft.com/en-us/powershell/module/scheduledtasks/register-scheduledtask?view=win10-ps#examples

Require admin

Put this at the top of the script:
#Requires -RunAsAdministrator

https://serverfault.com/a/676573/72176

Current user

https://stackoverflow.com/questions/2085744/how-do-i-get-the-current-username-in-windows-powershell

Trigger a powershell script from a windows event

https://blogs.technet.microsoft.com/wincat/2011/08/25/trigger-a-powershell-script-from-a-windows-event/

This seems to contain the right stuff. It seems I can do this:

1. export the manually created task (which I have already created)
2. Use schtasks /create /TN "MyTasks\vmware-auto-suspend" /XML vmware-auto-suspend.xml

Get-Winevent

https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-6

[fatso83]

Managed to find the way! Just need to document it and perhaps create a small installer? Or at least some steps that explains where to put the script and how to install the task using the xml file.

https://superuser.com/questions/1488344/create-a-scheduled-task-to-trigger-on-a-log-event-with-a-specific-event-id/1488352#1488352

full xml event trigger

<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2019-09-30T10:56:39.7659023</Date>
    <Author>DESKTOP-BPAGGTR\dvlpr</Author>
    <URI>\Steng ned VMWare</URI>
  </RegistrationInfo>
  <Triggers>
    <EventTrigger>
      <Enabled>true</Enabled>
      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="System"&gt;&lt;Select Path="System"&gt;*[System[Provider[@Name='User32'] and EventID=1074]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
    </EventTrigger>
    <EventTrigger>
      <Enabled>true</Enabled>
      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="System"&gt;&lt;Select Path="System"&gt;*[System[Provider[@Name='Microsoft-Windows-Winlogon'] and EventID=7002]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
    </EventTrigger>
    <EventTrigger>
      <Enabled>true</Enabled>
      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Microsoft-Windows-Forwarding/Operational"&gt;&lt;Select Path="Microsoft-Windows-Forwarding/Operational"&gt;*[System[Provider[@Name='Microsoft-Windows-Forwarding'] and EventID=6005]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
    </EventTrigger>
    <EventTrigger>
      <Enabled>true</Enabled>
      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Microsoft-Windows-Forwarding/Operational"&gt;&lt;Select Path="Microsoft-Windows-Forwarding/Operational"&gt;*[System[Provider[@Name='Microsoft-Windows-Forwarding'] and EventID=6006]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
    </EventTrigger>
    <EventTrigger>
      <Enabled>false</Enabled>
      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Security"&gt;&lt;Select Path="Security"&gt;*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4634]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
    </EventTrigger>
    <EventTrigger>
      <Enabled>true</Enabled>
      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Security"&gt;&lt;Select Path="Security"&gt;*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4647]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
    </EventTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>S-1-5-21-328277108-3771091065-727759522-1001</UserId>
      <LogonType>InteractiveToken</LogonType>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <AllowHardTerminate>true</AllowHardTerminate>
    <StartWhenAvailable>false</StartWhenAvailable>
    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
    <IdleSettings>
      <StopOnIdleEnd>true</StopOnIdleEnd>
      <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <WakeToRun>false</WakeToRun>
    <ExecutionTimeLimit>PT72H</ExecutionTimeLimit>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>C:\Users\dvlpr\OneDrive\Dokumenter\auto-suspend-vm.bat</Command>
    </Exec>
  </Actions>
</Task>