Where Windows Stores Scheduled Tasks in Registry

In modern versions of Windows, Task Scheduler stores its internal metadata, state information, and binary execution definitions within the Windows Registry under the TaskCache key. While raw XML definitions for scheduled tasks reside on the file system, the Windows Task Scheduler service relies on specific Registry structures to index tasks, track runtime states, correlate triggers, and verify task integrity.

The Primary Registry Location

All modern scheduled task registry data is located in the following path:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache

This root key contains several distinct subkeys that manage how tasks are organized, indexed, and executed.

Core Subkeys in TaskCache

The TaskCache registry hive is divided into structural categories:

1. TaskCache\Tree

The Tree key mirrors the visual folder hierarchy displayed in the Task Scheduler user interface. * Each subkey corresponds to a folder or task name (e.g., TaskCache\Tree\Microsoft\Windows\Defrag\ScheduledDefrag). * Inside a specific task subkey, you will find an Id string value containing the task’s unique GUID (e.g., {A1B2C3D4-...}). * It may also contain an Index value and an SD (Security Descriptor) binary value defining permissions.

2. TaskCache\Tasks

The Tasks key stores the actual operational metadata and binary definitions for every task. * Each subkey is named using the task’s GUID matching the Id found in the Tree hierarchy. * Key values stored inside each GUID subkey include: * Actions: Binary data containing the executable path, arguments, and working directory. * Triggers: Binary definition of the schedules, event triggers, or logon conditions. * DynamicInfo: Binary tracking data updated during runtime, containing the last run time, last result (exit code), and current state. * Path: The visual Task Scheduler path corresponding to the entry in Tree. * Hash: A computed hash used by Windows to ensure task integrity.

3. Execution Category Subkeys

Windows categorizes task GUIDs by their trigger mechanism to optimize system startup and event processing: * TaskCache\Boot: Lists GUIDs of tasks configured to run at system startup. * TaskCache\Logon: Lists GUIDs of tasks configured to trigger upon user logon. * TaskCache\Plain: Lists GUIDs of tasks without specialized logon or boot triggers (such as standard time-based schedules). * TaskCache\Maintenance: Lists GUIDs for automatic system maintenance tasks.

Relationship to the File System

The Registry entries inside TaskCache work in tandem with the XML task definition files located at C:\Windows\System32\Tasks.

When a scheduled task is created, Windows creates the human-readable XML configuration in the System32\Tasks directory and simultaneously compiles the binary structures and tracking metadata into TaskCache\Tasks and TaskCache\Tree. If the registry entries and the file system XML definitions become desynchronized or corrupted, the Task Scheduler service will report that the task definition is missing or invalid.