Home / server / Questions / 732559
In Process
ETL
Asked: 2015-10-30 07:42:11 +0800 CST

Why Windows is running programs via Task Scheduler

  • 772

Running Windows Server 2008R2 as a Remote Desktop Session host. I noticed a while ago that there are tons of tasks being created in Task Scheduler. These are not created by the users themselves.

Today, I noticed a user who had 100s of rundll32.exe process with the command line of:

c:\windows\system32\rundll32.exe c:\windows\system32\pcwutl.dll,CreateAndRunTask -path "\\server\programs\program.exe"

What the heck? Anybody knows why Windows is doing that?

The program being run is an old VB 6 program, if that matters. It's run from a shortcut the users have on their desktop which points to the .exe on a network share. I haven't seen the code of that program in a long long time but I don't recall it doing anything special, out of the ordinary.

Also, there are actually in Task Scheduler, some tasks for program #1 and some for program #2 - both are old VB 6 programs. Some of the task start the program through the network share, some from the local drive (I have the program in two places and some users have shortcuts pointing to local drive, some to network share).

The tasks in Task Scheduler are named with a UUID of some sort. The task is marked with the following options:

  • Run only when user is logged on
  • Trigger: At task creation/modification
  • Action: start a program (the program described above)

New data

According to the file information, the DLL is the Program Compatibility Troubleshooter Helper. Still don't know why it does that...

windows-server-2008-r2

1 Answers

  1. A basic Windows2008+ installation has tens of pre-scheduled task for various activities, and yes, sometime they remain "stuck" for whatever reason.

    rundll32.exe is a dll used as an "entry point" for launching many system-related tasks. For example, many control panel applets relay on it launch/work. As you found, it is heavily used for scheduled tasks also.

    Back to your original question: yes, it is normal for Windows to have many scheduled task and to launch them with rundll32.exe. However, only you can tell if the scheduled VB6 programs are good/bad and if they should be launched with different options.

    • 0