Windows Registry Background Task Triggers Location

Windows stores registered background tasks, work items, and triggers in several dedicated registry locations depending on whether they belong to the traditional Windows Task Scheduler or the modern Windows Background Infrastructure (BI) broker. This guide details the exact registry paths within the Windows Registry Editor (regedit) where these tasks, their activation triggers, and their runtime definitions are maintained.

1. Traditional Windows Task Scheduler Triggers and Work Items

The Windows Task Scheduler engine keeps its definitions, metadata, and binary trigger configurations under the following primary registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache

Inside TaskCache, data is organized into specific subkeys:

• TaskCache\Tasks: Contains a list of subkeys named by GUID for every registered task. Each GUID entry stores:
  • Triggers: Binary data containing the scheduling rules, conditions, and trigger types.
  • Actions: Binary definitions of the executable or script to launch.
  • Path: The logical path and name of the task.
  • DynamicInfo: Execution status, last run time, and state.
• TaskCache\Tree: Replicates the folder structure seen in the Task Scheduler GUI. Each entry matches a task name and points to the corresponding task GUID via the Id value.
• TaskCache\Plain: Lists GUIDs of standard, non-boot, and non-logon tasks.
• TaskCache\Boot: Lists GUIDs of tasks triggered at system startup.
• TaskCache\Logon: Lists GUIDs of tasks triggered at user logon.

2. Modern App Background Tasks and System Work Items

For Universal Windows Platform (UWP) apps, Packaged desktop apps, and system components managed by the Background Infrastructure service, tasks and triggers are stored across the following locations:

Core Background Infrastructure Settings

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\BackgroundInfrastructure

This key contains low-level parameters and work items for the Background Infrastructure Broker, which manages event-triggered work items such as network changes, push notifications, and maintenance triggers.

Background Execution Permissions and App Triggers

• System-wide:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications
• Per-User:
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications

These keys store package family names and determine whether specific applications are allowed to register background work items and fire background triggers.

3. Background Activity Moderator (BAM)

To see historically monitored background activities and executables managed by the Windows Background Activity Moderator service, navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\{User-SID}

This location stores timestamps and executable paths for applications that execute background tasks under each user profile.