Find Background Task Triggers in Windows Registry

In Windows, background tasks, triggers, and scheduled work items are recorded across specific Registry paths depending on whether they belong to the Modern App Background Infrastructure (UWP/Broker tasks) or the standard Windows Task Scheduler engine. This guide details the exact locations within the Registry Editor (regedit.exe) where system administrators and developers can inspect registered background work items, triggers, and execution configurations.

1. Modern Background Infrastructure (UWP and Broker Tasks)

For modern Windows applications and universal background triggers (such as maintenance triggers, push notifications, and network state changes), Windows registers task metadata under the Background Infrastructure keys.

• Trigger and Broker Configuration:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\BackgroundInfrastructure
  Inside this key, you can view global parameters and system brokers that manage background activation.

• System-Wide Background App Permissions and Triggers:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications
  Lists applications registered to execute background work along with their respective Package Family Names (PFN) and system-level permissions.

• User-Specific Background Task Registrations:
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications
  Contains per-user trigger permissions and execution state flags for apps allowed to run background tasks.

2. Task Scheduler Background Work Items and Triggers

Standard Windows background tasks and system jobs are managed by the Task Scheduler cache, which stores the binary definitions of triggers, actions, and task hierarchies.

• Registered Task Definitions and Triggers:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks
  Each subkey is a GUID representing a registered background task. Inside each GUID subkey, you will find:

  • Actions: The binary data defining what executable or script runs.
  • Triggers: The binary definition of the schedule, event trigger, or idle state that activates the task.
  • DynamicInfo: The current execution state and registration timestamps.

• Task Tree Hierarchy:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree
  Displays the logical folder structure identical to the Task Scheduler UI. Clicking a specific task name reveals an Id string, which maps directly to the corresponding GUID in the Tasks key above.

• Boot and Logon Specific Work Items:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain
    These keys act as fast-lookup indices for tasks triggered by system startup, user sign-in, or standard scheduling.