peass-ng/PEASS-ng · error · NotSupportedException

Enumeration of task history not available on systems prior t

Error message

Enumeration of task history not available on systems prior to Windows Vista and Windows Server 2008.

What it means

TaskEventLog.Initialize throws NotSupportedException when the current OS is older than Windows Vista / Server 2008. Task history enumeration relies on the Windows Event Log (Vista+) channel 'Microsoft-Windows-TaskScheduler/Operational', which does not exist on XP/2003. The library intentionally fails fast instead of returning empty results.

Source

Thrown at winPEAS/winPEASexe/winPEAS/TaskScheduler/TaskEvent.cs:762

                sb.Append(']');
            }
            if (!string.IsNullOrEmpty(taskName))
            {
                if (sb.Length == 1)
                    sb.Append('[');
                else
                    sb.Append("]" + AND + "*[");
                sb.AppendFormat("EventData[Data[@Name='TaskName']='{0}']", taskName);
            }
            if (sb.Length > 1)
                sb.Append(']');
            return string.Format(queryString, sb);
        }

        private void Initialize(string machineName, string query, bool revDir, string domain = null, string user = null, string password = null)
        {
            if (!IsVistaOrLater)
                throw new NotSupportedException("Enumeration of task history not available on systems prior to Windows Vista and Windows Server 2008.");

            System.Security.SecureString spwd = null;
            if (password != null)
            {
                spwd = new System.Security.SecureString();
                foreach (char c in password)
                    spwd.AppendChar(c);
            }

            Query = new EventLogQuery(TSEventLogPath, PathType.LogName, query) { ReverseDirection = revDir };
            if (machineName != null && machineName != "." && !machineName.Equals(Environment.MachineName, StringComparison.InvariantCultureIgnoreCase))
                Query.Session = new EventLogSession(machineName, domain, user, spwd, SessionAuthentication.Default);
        }

        /// <summary>
        /// Gets the total number of events for this task.
        /// </summary>
        public long Count

View on GitHub (pinned to 53fb989abc)

Solutions

1. Check TaskEventLog.IsVistaOrLater (or OS version >= 6.0) before constructing TaskEventLog and skip history enumeration on legacy systems
2. Wrap TaskEventLog construction in try/catch for NotSupportedException and degrade gracefully (skip task history)
3. Target/require Windows Vista or newer for task-history functionality

Example fix

// before
var log = new TaskEventLog();
foreach (var e in log) Process(e);
// after
if (TaskEventLog.IsVistaOrLater)
{
    var log = new TaskEventLog();
    foreach (var e in log) Process(e);
}

bool canEnumerate = Environment.OSVersion.Version.Major >= 6;

try { var log = new TaskEventLog(); /* enumerate */ }
catch (NotSupportedException) { /* skip task history on pre-Vista */ }

When it happens

Trigger: Constructing a TaskEventLog (e.g. new TaskEventLog() or with a machine name/query) on an OS where Environment.OSVersion is below 6.0, causing Initialize to run its IsVistaOrLater check and throw.

Common situations: Running winPEAS or an app built on Microsoft.Win32.TaskScheduler on legacy Windows XP/Server 2003 machines, or in environments where the OS version check wrongly reports pre-Vista (compatibility shims, old .NET targets).

Related errors

• Task history not available on systems prior to Windows Vista
• On systems prior to Windows 10, all individual parameters mu
• On systems prior to Windows 10, no individual parameter may
• volumeGuid
• Resources.Not_A_Valid_Guid

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/7fc1a4aa312ae1de. Report an issue: GitHub.