Extracting parameters from Event triggered Scheduled Task RRS feed

  • Question

  • Based off a tutorial in triggering an Scheduled Task when an Event occurs in Server 2008R2, I'd like to know if ANY details of the Event can be passed to the Scheduled Task.

    I saw someone suggesting that I have to modify the Task's XML file with some parameters in the EventTriggers section, such as:

     <Value name="EventID">Event/System/EventID</Value>

    Then the parameter $EventID could be passed to the application, right?

    Apparently not quite. A simple Powershell script that displays the parameters passed to it never shows a single one when used in this fashion.

    Would love some insight to see if this is possible?

    -- Austin Arrowsmith, Ebor Administrator
    Tuesday, February 22, 2011 7:02 AM

All replies

  • Any update on this?
    Monday, September 12, 2011 5:02 PM
  • Sadly no. I gave up and tackled the task in a different approach. This would have been the nicest, but I never found a way with the limited time I had (have) to look at it.
    -- Austin Arrowsmith, Ebor Administrator
    Friday, September 16, 2011 7:35 AM
  • Thanks for the reply - I got it working with that info - and a bit more - it's an xquery string.

    I needed something to write to a log when files were deleted - aka Security event log id 4663.  I attached the task to the event id and modified the xml task.  Then pointed it to a powershell script with parameters of user and file deleted.  That just dumps it down to a size-limited log file.

    Here's my relevant task.xml sections:

            <Value name="ObjectName">Event/EventData/Data[@Name='ObjectName']</Value>
            <Value name="SubjectUserName">Event/EventData/Data[@Name='SubjectUserName']</Value>
      <Actions Context="Author">
          <Arguments>-command "&amp; 'C:\ScheduledTasks\Security Log - Event ID 4663\Security Log - Event ID 4663.ps1'" '$(SubjectUserName)' '$(ObjectName)'</Arguments>


    • Proposed as answer by Andrew Teets Thursday, February 28, 2013 4:57 PM
    Friday, September 16, 2011 2:08 PM