Forum Discussion

Schulzi's avatar
Schulzi
Copper Contributor
Oct 01, 2020

Scheduled Task

Hi everyone,

 

I created a Scheduled-Task with Powershell that looks like that:

$Execute = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
$Argument = "Z:\Applications\002Diverse_Installationen\Powershell\Scripts_WIP\EnableActiveProbing.ps1"
$At = "07:00"
$Repeat = (New-TimeSpan -Minutes 60)
$Task_Name = "Enable Active Probing "
$Execution_Time_Limit = (New-TimeSpan -Minutes 5)
$User = "NT-AUTORITÄT\SYSTEM"

$Action = New-ScheduledTaskAction -Execute $Execute -Argument $Argument
$Trigger = New-ScheduledTaskTrigger -Once -At $At -RepetitionInterval $Repeat 
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit $Execution_Time_Limit
$Task = New-ScheduledTask -Action $Action -Trigger $Trigger -Settings $Settings 

Register-ScheduledTask -TaskName $Task_Name -InputObject $Task -User $User

I works fine BUT if it gets executed, a little PS-Window is displayed for a second...

Are there any arguments in the Task-Scheduler (under $Argument) to start the PS window minimized WITHOUT using a .vbs-Script?

So far i tried putting "-WindowStyle minimized/hidden" as an Argument, only thing that happened was a shorter flash of the window.

 

 

System:

Win10 2004

Build 19041.450

 

 

Greetings 

Yannik Schulz

9 Replies

  • Tom_S's avatar
    Tom_S
    Copper Contributor

    Schulzi wrote:

    Are there any arguments in the Task-Scheduler (under $Argument) to start the PS window minimized WITHOUT using a .vbs-Script?

    So far i tried putting "-WindowStyle minimized/hidden" as an Argument, only thing that happened was a shorter flash of the window.

    Schulzi ,

    From about_Powershell.exe try

    -NoLogo

    and/or

    -NonInteractive

    It isn't clear from your message that you tried only -WindowStyle Hidden.  The string "minimized/hidden" is not a valid value.  Perhaps you meant minimized | hidden, meaning "OR"?

    • Schulzi's avatar
      Schulzi
      Copper Contributor
      I did mean "or", I know that "/" in powershell isn't right, just a quicker way to descibe it here
  • Animesh Joshi's avatar
    Animesh Joshi
    Copper Contributor
    What I'm about to suggest is not ideal. However, if the task doesn't need to run under a specific user context, and is configured to do something on a computer level affecting all users, you could run the task under SYSTEM account. This way the active desktop of SYSTEM account where we should expect the PS windows to flash won't be visible to the currently logged on user.
    • Tom_S's avatar
      Tom_S
      Copper Contributor
      Respectfully, it is far better to run a scheduled task as NT AUTHORITY\LocalService or NT AUTHORITY\NetworkService . Scheduled tasks should emphatically _not_ be run as NT AUTHORITY\SYSTEM. That account includes Full administrative credentials. Many easy to make mistakes in the task, such as having the script file in a writeable directory would permit an attacker full escalation to local machine admin.
      • Schulzi's avatar
        Schulzi
        Copper Contributor

        Hi Tom_S

         

        I could try to use a different "System Authority" to run the Task.

        The problem using a "System Authority" is, that this (discoverd that in the test with "NT-Authority\System") Authority DEOS NOT have read and/or writing privileges on our server where the scheduled task is "stored".

         

        I guess you could probably use a hidden folder in windows where only Domain-Admins and System has read/wirte rights on it, but is there an easier way to do that?

         

         

        You know: "The less, the better."

         

        Greetings

        Yannik Schulz

    • Schulzi's avatar
      Schulzi
      Copper Contributor

      Hi farismalaeb

       

      I already tried putting "-windowstyle minimized/hidden " under $Arguments written like following:

      $Argument = "-windowstyle minimized/hidden -file "Z:\Applications\...\"

       

      As I already mentioned the only thign that happend was a shorter Flash of the window

       

       

      Greetings

      Yannik Schulz

       

      • farismalaeb's avatar
        farismalaeb
        Steel Contributor

        Schulzi 

        Oh yea, sorry, I was looking through the code.

        I agree with you, I even try it with CMD and the same thing happened, I try to use the cmd internal command start /min it successfully executed PowerShell in minimized state, but cmd when it starts, it flashes for 1 sec and then disappears, then Powershell executed in min state.

        I also set the scheduled task to be hidden but still the same, 1-sec flashes and then disappear.

        if you want it completely invisible, then it seems that you will need to use VBS.

Resources