Windows 10 Task Scheduler and Management BYOD Devices

%3CLINGO-SUB%20id%3D%22lingo-sub-2277084%22%20slang%3D%22en-US%22%3EWindows%2010%20Task%20Scheduler%20and%20Management%20BYOD%20Devices%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2277084%22%20slang%3D%22en-US%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHello%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20a%20question%20that%20about%20a%20solution%20i%20am%20considering%20using%20PowerShell%20and%20MEM%20on%20BYOD%20systems.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EPlease%20excuse%20me%20as%20I%20am%20an%20amateur%20but%20are%20trying%20to%20increase%20my%20skills%20to%20make%20myself%20employable%20in%20the%20ICT%20field%2C%20so%20if%20it%20is%20not%20considered%20%22best%20practice%22%20explain%20why.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20a%20test%20tenant%20with%20a%20few%20joined%20machines%20and%20quite%20a%20few%20more%20BYOD%20personal%20PC's.%26nbsp%3B%20I%20use%20this%20for%20testing%2C%20research%20and%20learning%20how%20to%20manage%20computers.%26nbsp%3B%20My%20goal%20here%20is%20not%20to%20lock%20them%20down%20like%20in%20a%20corporate%20environment%20but%20to%20manage%20aspects%20of%20their%20security%20and%20gain%20knowledge%20and%20skills%20in%20MSDE%20hunting%20and%20other%20functionality.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMy%20question%20is%20this.%26nbsp%3B%20Whilst%20looking%20at%20a%20my%20security%20recommendations%20I%20came%20across%20a%20article%20to%20%22wake%22%20devices%20for%20maintenance.%26nbsp%3B%20I%20cant%20do%20this%20via%20GP%20so%20I%20had%20to%20use%20other%20methods.%26nbsp%3B%20I%20found%20that%20using%20PowerShell%20I%20can%20alter%20the%20scheduled%20tasks%20on%20a%20device%2C%20either%20joined%20or%20personal%20and%20I%20am%20interested%20in%20using%20this%20rather%20than%20using%20PowerShell%20to%20alter%20the%20registry%20keys.%26nbsp%3B%20I%20could%20use%20this%20for%20Google%20software%20for%20example%20(Google%20places%20entries%20in%20the%20task%20scheduler)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESample%20code%20like%20so%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-powershell%22%3E%3CCODE%3E%26lt%3B%23%20%0A%0ASource%20-%20%20https%3A%2F%2Frichardbalsley.com%2Fconfiguring-windows-10-devices-to-wake-and-update-outside-of-class-time%0ALookup%20variables%20want%20to%20run%20whether%20idle%20or%20not%0A%0ACreated%2005-04-2021%0A%0ATesting%20-%20Draft%20Only%0A%0A%23%26gt%3B%0A%0A%0A%0A%0A%0A%0A%0A%20%24task%20%3D%20Get-ScheduledTask%20-TaskName%20InvokeMaintenance%20-ErrorAction%20SilentlyContinue%0A%0A%0AIf(-not%20%24task)%0A%0A%7B%0A%0A%24ST_A%20%3D%20New-ScheduledTaskAction%20-Execute%20%22cmd%22%20-Argument%20%22%2Fc%22%0A%0A%24ST_T%20%3D%20New-ScheduledTaskTrigger%20-AtStartup%0A%0A%24ST_S%20%3D%20New-ScheduledTaskSettingsSet%20-DisallowHardTerminate%20-RunOnlyIfIdle%20-MaintenancePeriod%2024%3A00%3A00%20-StartWhenAvailable%20-WakeToRun%20-ExecutionTimeLimit%2000%3A30%3A00%20-Priority%200%0A%0A%24ST_P%20%3D%20New-ScheduledTaskPrincipal%20-UserId%20%22SYSTEM%22%20-LogonType%20ServiceAccount%20-RunLevel%20Highest%0A%0ARegister-ScheduledTask%20-TaskName%20%22InvokeMaintenance%22%20-Action%20%24ST_A%20-Trigger%20%24ST_T%20-Settings%20%24ST_S%20-Principal%20%24ST_P%0A%0A%0A%0A%0A%0A%7D%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20somebody%20would%20be%20kind%20enough%20to%20point%20me%20to%20a%20blog%2C%20forum%20other%20other%20medium%20that%20goes%20into%20this%20in%20more%20detail%20or%20give%20me%20examples%2C%20pitfalls%20or%20just%20a%20professional%20opinion%20on%20this%2C%20I%20would%20be%20appreciate%20it.%26nbsp%3B%20This%20code%20is%20actually%20setting%20a%20entry%2C%20but%20the%20machines%20are%20not%20waking.%26nbsp%3B%20I%20assume%20its%20a%20idle%20time%20problem.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20aware%20that%20this%20is%20an%20attack%20vector%2C%20but%20I%20can%20run%20queries%20in%20MSDE%20and%20monitor%20the%20processes%2C%20and%20should%20probably%20be%20doing%20this%20anyway.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThankyou%20in%20advance%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2277084%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EIntune%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMobile%20Device%20Management%20(MDM)%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2277673%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%2010%20Task%20Scheduler%20and%20Management%20BYOD%20Devices%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2277673%22%20slang%3D%22en-US%22%3EHI%2C%3CBR%20%2F%3E%3CBR%20%2F%3EFirst%20step%20will%20be%20determing%20if%20MaintenanceDisabled%20is%20not%20disabled%20(to%20be%20100%25%20sure)%3CBR%20%2F%3E%3CBR%20%2F%3EHKEY_LOCAL_MACHINE%5CSOFTWARE%5CMicrosoft%5CWindows%3CBR%20%2F%3ENT%5CCurrentVersion%5CSchedule%5CMaintenance%20or%20you%20could%20create%20a%20DWORD%20WakeUp%3CBR%20%2F%3E%3CBR%20%2F%3EYou%20could%20also%20make%20sure%20wake%20timers%20are%20enabled%20by%20configuring%20the%20powerplan%3A%3CBR%20%2F%3Epowercfg%20%2FSETDCVALUEINDEX%20SCHEME_CURRENT%20238c9fa8-0aad-41ed-83f4-97be242c8f20%20bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d%201%3CBR%20%2F%3Epowercfg%20%2FSETACVALUEINDEX%20SCHEME_CURRENT%20238c9fa8-0aad-41ed-83f4-97be242c8f20%20bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d%201%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2285385%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%2010%20Task%20Scheduler%20and%20Management%20BYOD%20Devices%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2285385%22%20slang%3D%22en-US%22%3ERudy%2C%3CBR%20%2F%3E%3CBR%20%2F%3ESorry%20I%20took%20so%20long%20to%20get%20back%20to%20you.%20The%20registry%20entry%20you%20mentioned%20is%20non%20existent%2C%20and%20I%20don't%20want%20to%20stuff%20with%20the%20power%20profiles.%20I%20am%20still%20leaning%20towards%20using%20scheduler%20but%20are%20looking%20at%20the%20code%20and%20current%20entries%20more%20closely.%3CBR%20%2F%3E%3CBR%20%2F%3EI%20will%20get%20back%20to%20you.%20Thanks.%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E
Contributor

 

Hello,

 

I have a question that about a solution i am considering using PowerShell and MEM on BYOD systems.

 

Please excuse me as I am an amateur but are trying to increase my skills to make myself employable in the ICT field, so if it is not considered "best practice" explain why.

 

I have a test tenant with a few joined machines and quite a few more BYOD personal PC's.  I use this for testing, research and learning how to manage computers.  My goal here is not to lock them down like in a corporate environment but to manage aspects of their security and gain knowledge and skills in MSDE hunting and other functionality.

 

My question is this.  Whilst looking at a my security recommendations I came across a article to "wake" devices for maintenance.  I cant do this via GP so I had to use other methods.  I found that using PowerShell I can alter the scheduled tasks on a device, either joined or personal and I am interested in using this rather than using PowerShell to alter the registry keys.  I could use this for Google software for example (Google places entries in the task scheduler)

 

Sample code like so

 

 

<# 

Source -  https://richardbalsley.com/configuring-windows-10-devices-to-wake-and-update-outside-of-class-time
Lookup variables want to run whether idle or not

Created 05-04-2021

Testing - Draft Only

#>







 $task = Get-ScheduledTask -TaskName InvokeMaintenance -ErrorAction SilentlyContinue


If(-not $task)

{

$ST_A = New-ScheduledTaskAction -Execute "cmd" -Argument "/c"

$ST_T = New-ScheduledTaskTrigger -AtStartup

$ST_S = New-ScheduledTaskSettingsSet -DisallowHardTerminate -RunOnlyIfIdle -MaintenancePeriod 24:00:00 -StartWhenAvailable -WakeToRun -ExecutionTimeLimit 00:30:00 -Priority 0

$ST_P = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest

Register-ScheduledTask -TaskName "InvokeMaintenance" -Action $ST_A -Trigger $ST_T -Settings $ST_S -Principal $ST_P





}

 

 

If somebody would be kind enough to point me to a blog, forum other other medium that goes into this in more detail or give me examples, pitfalls or just a professional opinion on this, I would be appreciate it.  This code is actually setting a entry, but the machines are not waking.  I assume its a idle time problem.

 

I am aware that this is an attack vector, but I can run queries in MSDE and monitor the processes, and should probably be doing this anyway.

 

Thankyou in advance

 

 

2 Replies
HI,

First step will be determing if MaintenanceDisabled is not disabled (to be 100% sure)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Schedule\Maintenance or you could create a DWORD WakeUp

You could also make sure wake timers are enabled by configuring the powerplan:
powercfg /SETDCVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1
powercfg /SETACVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1
Rudy,

Sorry I took so long to get back to you. The registry entry you mentioned is non existent, and I don't want to stuff with the power profiles. I am still leaning towards using scheduler but are looking at the code and current entries more closely.

I will get back to you. Thanks.