4.10.15. Scheduler service

The scheduler service runs RPC services allowing remote configuration of scheduled tasks (AT jobs). These RPC services are available on two endpoints:

Before Windows XP the Scheduler service was implemented in a single process, mstask.exe. Starting with Windows XP, the Scheduler service runs in a svchost.exe instance process (schedsvc.dll) and runs an additional RPC service (the third one in the list below).

The interfaces identifiers of these RPC services are:

X:\>ifids -p ncacn_np -e \pipe\atsvc \\.
Interfaces: 51

[...]

  1ff70682-0a51-30e8-076d-740be8cee98b v1.0
  378e52b0-c0a9-11cf-822d-00aa0051e40f v1.0
  0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53 v1.0

X:\>ifids -p ncacn_ip_tcp -e 3136 127.0.0.1
Interfaces: 51

[...]

  1ff70682-0a51-30e8-076d-740be8cee98b v1.0
  378e52b0-c0a9-11cf-822d-00aa0051e40f v1.0
  0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53 v1.0

X:\>

IDL (Interface Definition Language) for the atsvc interface is available in Samba 4 [79].

Table 4.61. atsvc operations

InterfaceOperation numberOperation name
1ff70682-0a51-30e8-076d-740be8cee98b v1.0: atsvc  
 0x00NetrJobAdd
 0x01NetrJobDel
 0x02NetrJobEnum
 0x03NetrJobGetInfo

Enumerating AT jobs:

Adding or removing an AT job:

Obtaining details about an AT job:

Submission of AT jobs is by default restricted to only members of the Administrators group. On domain controllers, it is possible to also allow members of the Server Operators group to submit AT jobs, by setting the SubmitControl registry value to 1 (not recommended).

Table 4.62. sasec operations

InterfaceOperation numberOperation name
378e52b0-c0a9-11cf-822d-00aa0051e40f v1.0: sasec  
 0x00SASetAccountInformation
 0x01SASetNSAccountInformation
 0x02SAGetNSAccountInformation
 0x03SAGetAccountInformation

The idletask interface was added in Windows XP:

Table 4.63. idletask operations

InterfaceOperation numberOperation name
0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53 v1.0: idletask  
 0x00ItSrvRegisterIdleTask
 0x01ItSrvUnregisterIdleTask
 0x02ItSrvProcessIdleTasks
 0x03ItSrvSetDetectionParameters

In Windows Vista, a new interface, ITaskSchedulerService, was added

Y:\>ifids -p ncacn_np -e \pipe\atsvc \\.
Interfaces: 56

[...]

  0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53 v1.0
  1ff70682-0a51-30e8-076d-740be8cee98b v1.0
  378e52b0-c0a9-11cf-822d-00aa0051e40f v1.0
  86d35949-83c9-4044-b424-db363231fd0c v1.0

[...]

Table 4.64. ITaskSchedulerService operations

InterfaceOperation numberOperation name
86d35949-83c9-4044-b424-db363231fd0c v1.0: ITaskSchedulerService  
 0x00SchRpcHighestVersion
 0x01SchRpcRegisterTask
 0x02SchRpcRetrieveTask
 0x03SchRpcCreateFolder
 0x04SchRpcSetSecurity
 0x05SchRpcGetSecurity
 0x06SchRpcEnumFolder
 0x07SchRpcEnumTasks
 0x08SchRpcEnumInstances
 0x09SchRpcGetInstanceInfo
 0x0aSchRpcStopInstance
 0x0bSchRpcStop
 0x0cSchRpcRun
 0x0dSchRpcDelete
 0x0eSchRpcRename
 0x0fSchRpcScheduledRuntimes
 0x10SchRpcGetLastRunInfo
 0x11SchRpcGetTaskInfo