Passing event details as arguments through a scheduled task to the action program

In this post I am going to schedule a task that runs a program when a certain event occurs, and pass details of that event as command line parameters to the action program


This is a simple windows script that prints back any command line arguments passed to it

args.vbs

if wscript.arguments.count > 0 then
 for i = 0 to wscript.arguments.count -1
  wscript.echo i & " " & wscript.arguments.item(i)
 next
else
 wscript.echo "no arguments"
end if
wscript.stdin.readline

In the Event Viewer I go to the event I wish to attach my task to. I chose event 4778 which (in Windows 2008 R2) occurs when a user reconnects to an existing session.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          5/22/2012 11:26:35 AM
Event ID:      4778
Task Category: Other Logon/Logoff Events
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      Server1.XXXXX.XXX
Description:
A session was reconnected to a Window Station.
Subject:
 Account Name:  administrator
 Account Domain:  XXXXX
 Logon ID:  0x4832b
Session:
 Session Name:  RDP-Tcp#0
Additional Information:
 Client Name:  XXX
 Client Address:  XXX.XXX.XXX.XXX
This event is generated when a user reconnects to an existing Terminal Services session, or when a user switches to an existing desktop using Fast User Switching.
I am going to pass the Date, Event ID, Computer, Account Name, Accoount Domain, Client Name and  Client Address to our script.
First we need to create the task.
From the Actions pane in the Event Viewer click: Attach Task To This Event

Continue the Wizard and choose for Action "Start a program"

I set the script host executable cscript.exe as the action program and gave it my script host as argument

A success confirmation message appears after finishing the wizard

Now to extract the event details and pass them to the script we have to modify the xml of the scheduled task, and add xquery path strings to the details we want to extract.
Export the task from the Task Scheduler.

The exported xml should be like this:

<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2012-05-23T08:42:50.2747257</Date>
    <Author>XXXXX\administrator</Author>
  </RegistrationInfo>
  <Triggers>
    <EventTrigger>
      <Enabled>true</Enabled>
      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Security"&gt;&lt;Select Path="Security"&gt;*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4778]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
    </EventTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>XXXXX\administrator</UserId>
      <LogonType>InteractiveToken</LogonType>
      <RunLevel>LeastPrivilege</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <AllowHardTerminate>true</AllowHardTerminate>
    <StartWhenAvailable>false</StartWhenAvailable>
    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
    <IdleSettings>
      <Duration>PT10M</Duration>
      <WaitTimeout>PT1H</WaitTimeout>
      <StopOnIdleEnd>true</StopOnIdleEnd>
      <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>    <WakeToRun>false</WakeToRun>
    <ExecutionTimeLimit>P3D</ExecutionTimeLimit>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>C:\Windows\System32\cscript.exe</Command>
      <Arguments>C:\ayman\args.vbs</Arguments>
    </Exec>
  </Actions>
</Task>


Paste the code below inside the EventTrigger node

<ValueQueries>
  <Value name="AccountDomain">Event/EventData/Data[@Name='AccountDomain']</Value>
  <Value name="AccountName">Event/EventData/Data[@Name='AccountName']</Value>
  <Value name="ClientAddress">Event/EventData/Data[@Name='ClientAddress']</Value>
  <Value name="ClientName">Event/EventData/Data[@Name='ClientName']</Value>
  <Value name="Computer">Event/System/Computer</Value>
  <Value name="EventID">Event/System/EventID</Value>
  <Value name="Logged">Event/System/TimeCreated/@SystemTime</Value>
</ValueQueries>

And add the following to Arguments inside Actions -> Exec

'$(AccountName)' '$(AccountDomain)' '$(ClientName)' '$(ClientAddress)' '$(EventID)' '$(Computer)' '$(Logged)'

So that the final xml looks like this

<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2012-05-23T08:42:50.2747257</Date>
    <Author>XXXXX\administrator</Author>
  </RegistrationInfo>
  <Triggers>
    <EventTrigger>
      <Enabled>true</Enabled>
      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Security"&gt;&lt;Select Path="Security"&gt;*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4778]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
      <ValueQueries>
        <Value name="AccountName">Event/EventData/Data[@Name='AccountName']</Value>
        <Value name="ClientName">Event/EventData/Data[@Name='ClientName']</Value>
 <Value name="AccountDomain">Event/EventData/Data[@Name='AccountDomain']</Value>
 <Value name="ClientAddress">Event/EventData/Data[@Name='ClientAddress']</Value>
 <Value name="EventID">Event/System/EventID</Value>
 <Value name="Computer">Event/System/Computer</Value>
 <Value name="Logged">Event/System/TimeCreated/@SystemTime</Value>
      </ValueQueries>
    </EventTrigger>
  </Triggers><Principals>
    <Principal id="Author">
      <UserId>XXXXX\administrator</UserId>
      <LogonType>InteractiveToken</LogonType>
      <RunLevel>LeastPrivilege</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <AllowHardTerminate>true</AllowHardTerminate>
    <StartWhenAvailable>false</StartWhenAvailable>
    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
    <IdleSettings>
      <Duration>PT10M</Duration>
      <WaitTimeout>PT1H</WaitTimeout>
      <StopOnIdleEnd>true</StopOnIdleEnd>
      <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <WakeToRun>false</WakeToRun>
    <ExecutionTimeLimit>P3D</ExecutionTimeLimit>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>C:\Windows\System32\cscript.exe</Command>
      <Arguments>C:\ayman\args.vbs '$(AccountName)' '$(AccountDomain)' '$(ClientName)' '$(ClientAddress)' '$(EventID)' '$(Computer)' '$(Logged)'</Arguments>
    </Exec>
  </Actions>
</Task>

Delete the task created by the wizard earlier and import the xml we edited instead.

Finally we need to fire the event, in my case I am going to disconnect and connect back to my remote desktop session.
Upon connecting I get the script output.