PowerShell Genie

Report scheduled tasks running under stale accounts

Script 1 min read Windows PowerShell 5.1 and PowerShell 7

Documentation: Microsoft Learn

Written and tested by Dhrub Bharali · Updated

The task inventory is read first, then each configured principal is translated to a SID.

The script

1PS> Get-ScheduledTask | Where-Object { $_.Principal.UserId } | ForEach-Object {
2PS> $user = $_.Principal.UserId
3PS> $exists = $true
4PS> try { [void] ([System.Security.Principal.NTAccount] $user).Translate([System.Security.Principal.SecurityIdentifier]) }
5PS> catch { $exists = $false }
6PS> if (-not $exists) {
7PS> $info = $_ | Get-ScheduledTaskInfo
8PS> [pscustomobject]@{ TaskPath= $_.TaskPath;TaskName= $_.TaskName;RunAs= $user;LastRunTime= $info.LastRunTime;LastTaskResult= $info.LastTaskResult }
9PS> } }

Script reader

Inspect before you run

Inspection only

Inspect the script below. It does not run in this browser.

Inspection only — no command has run.

    Show reference output

    Illustrative unresolved principal. A failed name-to-SID translation can also indicate lookup or connectivity problems; it does not prove the account was deleted. Note: tasks running as built-in principals (SYSTEM, LOCAL SERVICE, NETWORK SERVICE without the NT AUTHORITY\ prefix, or raw SIDs) will also fail translation — exclude NT AUTHORITY\* and well-known SIDs before treating a result as stale.

    TaskPath       : \
TaskName       : NightlyReport
RunAs          : CORP\retired-reporting
LastRunTime    : 2026-10-01 22:00:00
LastTaskResult : 2147943726
    Inspect this example’s structure

    Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.

    Get-ScheduledTask | Where-Object { $_.Principal.UserId } | ForEach-Object { $user = $_.Principal.UserId $exists = $true try { [void] ([System.Security.Principal.NTAccount] $user).Translate([System.Security.Principal.SecurityIdentifier]) } catch { $exists = $false } if (-not $exists) { $info = $_ | Get-ScheduledTaskInfo [pscustomobject]@{ TaskPath= $_.TaskPath;TaskName= $_.TaskName;RunAs= $user;LastRunTime= $info.LastRunTime;LastTaskResult= $info.LastTaskResult } } }
    1. Stage 1Get-ScheduledTaskPositional values or no named parameters
    2. Stage 2Where-ObjectPositional values or no named parameters
    3. Stage 3ForEach-ObjectPositional values or no named parameters

      How it works

      The task inventory is read first, then each configured principal is translated to a SID. A failed translation marks an account reference that Windows cannot currently resolve. Get-ScheduledTaskInfo adds run evidence without modifying the task.

      Adapting it

      For domain service accounts, combine this with an Active Directory status check so disabled-but-resolvable accounts are also reported.

      Primary documentation

      Where-Object reference · ForEach-Object reference

      Continue
      Genie guideReport scheduled tasks running under stale accounts

      The task inventory is read first, then each configured principal is translated to a SID.

      Explore PowerShell Genie

      Related