Repository navigation
Adds a new LiveResponse module wrapping NirSoft's TaskSchedulerView - #1117
Merged
AndrewRathbun merged 1 commit intoSep 15, 2026
Merged
Conversation
AndrewRathbun
approved these changes
Sep 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds a new LiveResponse module wrapping NirSoft's TaskSchedulerView to export the live state of Windows Task Scheduler tasks to CSV.
Verified directly against NirSoft's [own documentation, ask SchedulerView's /LoadFrom switch only supports ](documentation: SchedulerView's/LoadFrom switch supports only)1 (local machine) or 2 (remote computer); there's no offline/folder-load mode, so this can't process already-collected data the way most modules do.
Target: that Target collects the raw .xml task definitions from C:\Windows\System32\Tasks, which show how a task is defined but not its live runtime state. This module adds that missing piece: last run result, next scheduled run, current enabled/disabled status in a single readable CSV.
Testing: downloaded the real binary, ran it live via kape.exe --msource C: --mdest --module NirSoft_TaskSchedulerViewer --debug against my own machine, and got a real CSV back with 268 actual scheduled tasks and full detail per task (status, last/next run, triggers, executable, running account, etc.) — not a synthetic or empty test.
No existing module in the repo covers this tool.
Checklist:
Please replace every instance of
[ ]with[X]OR click on the checkboxes after you submit your PRGUIDfor my Target(s)/Module(s)Miscfolder or created a relevant subfolder with justification--tlist/--mlistand corrected any errorsN/Aunderneath the Documentation header