-->

how can i find the instanceid/correlation ID of th

2020-07-16 08:20发布

问题:

if i have a windows scheduled task that runs my EXE. is there a way from inside my EXE to find the scheduled task instance that triggered me?

回答1:

Easy answer for that would be: no.

Best thing you could do is programatically access either the task scheduler library and see whether the process you are is in "running" mode, get the PID of the process (scheduler actually writes it out in its history) and compare it to yours.

Easier thing to do would be accessing to system event logs and seeing if there's any mention of execution your exe file (though they may not be such a log if the exe was actually executed).

The only thing you can associate with your process is the caller (which might be NETWORK SERVICE or some predefined account) which do not give any information regarding it being scheduled.



回答2:

I tried for a while to solve this same issue, however I don't think it's possible using the current API. If you have a reference to the running task, you can get the PID of the task engine that started it. From there, you can to go to the task event log and look up the latest events with ID 200 (Action Started) having the same engine PID, however since you can have multiple task processes running beneath a single task engine, you can't go any farther with absolute certainty (e.g., a second instance of your process could be running under the same engine PID -- you won't be able to tell which correlation ID belongs to your target process.)