Windows Task Scheduler: sichere temporäre XML-/SDDL-Wiederherstellung nach unbestätigtem Readback

Can you share a minimal sample (XML and SDDL for the task) and the COM code that reproduces the issue?

Thanks, RLWA32. Below is a fully synthetic and reduced sample; it contains no production task export, account, path, SID, or log data. It is not run against Task Scheduler.

The scope is only bounded task-definition/security-descriptor update and conditional restoration. It is not application-completion evidence.

<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo><Description>Synthetic baseline</Description></RegistrationInfo>
  <Triggers />
  <Principals>
    <Principal id="ExamplePrincipal">
      <UserId>REPLACE_WITH_DISPOSABLE_TEST_PRINCIPAL</UserId>
      <LogonType>InteractiveToken</LogonType>
      <RunLevel>LeastPrivilege</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <StartWhenAvailable>false</StartWhenAvailable>
    <AllowStartOnDemand>false</AllowStartOnDemand>
    <Enabled>false</Enabled>
    <ExecutionTimeLimit>PT30S</ExecutionTimeLimit>
  </Settings>
  <Actions Context="ExamplePrincipal">
    <Exec><Command>REPLACE_WITH_INERT_TEST_COMMAND</Command></Exec>
  </Actions>
</Task>

Illustrative SDDL only:

O:<TEST_OWNER_SID>G:<TEST_GROUP_SID>D:P(A;;<TEST_ACCESS_MASK>;;;<TEST_OWNER_SID>)

The actual disposable test task’s descriptor is captured in memory and not printed. GetSecurityDescriptor(7) requests owner, group, and DACL only, not SACL.

$EnableDisposableLabWrites = $false
if (-not $EnableDisposableLabWrites) { throw 'ILLUSTRATIVE_ONLY_DO_NOT_RUN' }

$ErrorActionPreference = 'Stop'
$taskName = 'SyntheticDefinitionExample'

$service = New-Object -ComObject 'Schedule.Service'
$service.Connect()
$folder = $service.GetFolder('\')

function Read-Snapshot {
    $task = $folder.GetTask($taskName)
    if ($task.Enabled -or [int]$task.State -ne 1 -or
        [int]$task.GetInstances(0).Count -ne 0) {
        throw 'DISABLED_AND_INACTIVE_NOT_CONFIRMED'
    }
    [pscustomobject]@{
        Xml  = [string]$task.Xml
        Sddl = [string]$task.GetSecurityDescriptor(7)
    }
}

function Xml-Key([string]$xml) {
    $doc = New-Object System.Xml.XmlDocument
    $doc.XmlResolver = $null
    $doc.PreserveWhitespace = $false
    $doc.LoadXml($xml)
    $doc.OuterXml
}

function Same-Definition($left, $right) {
    [string]::Equals((Xml-Key $left), (Xml-Key $right),
        [StringComparison]::Ordinal)
}

$original = Read-Snapshot

$doc = New-Object System.Xml.XmlDocument
$doc.XmlResolver = $null
$doc.LoadXml($original.Xml)

$ns = New-Object System.Xml.XmlNamespaceManager($doc.NameTable)
$ns.AddNamespace('t', 'http://schemas.microsoft.com/windows/2004/02/mit/task')

$principal = $doc.SelectSingleNode(
    '/t:Task/t:Principals/t:Principal/t:UserId', $ns
).InnerText

$doc.SelectSingleNode(
    '/t:Task/t:RegistrationInfo/t:Description', $ns
).InnerText = 'Synthetic candidate'

$candidateXml = $doc.OuterXml

# TASK_UPDATE | TASK_IGNORE_REGISTRATION_TRIGGERS | TASK_DONT_ADD_PRINCIPAL_ACE
$flags = 4 -bor 16 -bor 32
$interactiveToken = 3

$updateReadback = 'UNCONFIRMED'
try {
    $null = $folder.RegisterTask(
        $taskName, $candidateXml, $flags,
        $principal, $null, $interactiveToken, $original.Sddl
    )

    $observed = Read-Snapshot
    if (-not (Same-Definition $observed.Xml $candidateXml) -or
        $observed.Sddl -cne $original.Sddl) {
        throw 'CANDIDATE_NOT_CONFIRMED'
    }
    $updateReadback = 'CONFIRMED'
} catch {
    # Do not assume the old definition remained intact.
    $updateReadback = 'UNCONFIRMED'
}

$restoreReadback = 'RESTORATION_UNCONFIRMED'
try {
    $current = Read-Snapshot

    if ($current.Sddl -cne $original.Sddl) {
        throw 'SECURITY_STATE_CHANGED'
    }

    if (Same-Definition $current.Xml $original.Xml) {
        $restoreReadback = 'ORIGINAL_DISABLED_CONFIRMED_NO_RESTORE_WRITE'
    }
    elseif (Same-Definition $current.Xml $candidateXml) {
        $null = $folder.RegisterTask(
            $taskName, $original.Xml, $flags,
            $principal, $null, $interactiveToken, $original.Sddl
        )

        $restored = Read-Snapshot
        if (-not (Same-Definition $restored.Xml $original.Xml) -or
            $restored.Sddl -cne $original.Sddl) {
            throw 'RESTORE_NOT_CONFIRMED'
        }
        $restoreReadback = 'ORIGINAL_DISABLED_RESTORE_READBACK_CONFIRMED'
    }
    else {
        throw 'UNRECOGNIZED_DEFINITION_NO_RESTORE_WRITE'
    }
} catch {
    # No retry, delete/recreate, start, or stop operation.
    $restoreReadback = 'RESTORATION_UNCONFIRMED'
}

[pscustomobject]@{
    UpdateReadback  = $updateReadback
    RestoreReadback = $restoreReadback
}

The example is deliberately conservative: disabled plus zero instances is only a snapshot, XML/SDDL comparison is not full semantic equivalence, and a hanging COM call has no timeout guarantee here.

The remaining questions are:

What atomicity does RegisterTask with TASK_UPDATE guarantee if its outcome or subsequent readback is unavailable?

Is there a supported identity/version or conditional-update mechanism to prevent a concurrent change between inspection and restoration?

What comparison is supported for service-normalized XML and security descriptors?

If registration/readback hangs rather than throws, what supported recovery proves the first operation has finished before restoration?

If anything is unknown, the intended result is RESTORATION_UNCONFIRMED, not a successful rollback inferred from task state.