peass-ng/PEASS-ng · error · SecurityException

Tasks which have been registered previously with stored pass

Error message

Tasks which have been registered previously with stored passwords must use the TaskFolder.RegisterTaskDefinition method for updates.

What it means

This error signals that a task update was attempted (e.g. via TaskDefinition changes re-registered directly) while the task's stored credentials include a password, which the Task Scheduler API forbids updating in place. Such tasks must be re-registered through TaskFolder.RegisterTaskDefinition with fresh credentials; the message documents this API limitation rather than a runtime fault.

Source

Thrown at winPEAS/winPEASexe/winPEAS/TaskScheduler/Task.cs:1358

            return ret;
        }

        /// <summary>Gets the security descriptor for the task. Not available to Task Scheduler 1.0.</summary>
        /// <param name="includeSections">Section(s) of the security descriptor to return.</param>
        /// <returns>The security descriptor for the task.</returns>
        /// <exception cref="NotV1SupportedException">Not supported under Task Scheduler 1.0.</exception>
        public string GetSecurityDescriptorSddlForm(SecurityInfos includeSections = defaultSecurityInfosSections) => v2Task != null ? v2Task.GetSecurityDescriptor((int)includeSections) : throw new NotV1SupportedException();

        /// <summary>
        /// Updates the task with any changes made to the <see cref="Definition"/> by calling <see
        /// cref="TaskFolder.RegisterTaskDefinition(string, TaskDefinition)"/> from the currently registered folder using the currently
        /// registered name.
        /// </summary>
        /// <exception cref="System.Security.SecurityException">Thrown if task was previously registered with a password.</exception>
        public void RegisterChanges()
        {
            if (Definition.Principal.RequiresPassword())
                throw new SecurityException("Tasks which have been registered previously with stored passwords must use the TaskFolder.RegisterTaskDefinition method for updates.");
            if (v2Task != null)
                TaskService.GetFolder(System.IO.Path.GetDirectoryName(Path)).RegisterTaskDefinition(Name, Definition, TaskCreation.Update, null, null, Definition.Principal.LogonType);
            else
                TaskService.RootFolder.RegisterTaskDefinition(Name, Definition);
        }

        /// <summary>Runs the registered task immediately.</summary>
        /// <param name="parameters">
        /// <para>
        /// The parameters used as values in the task actions. A maximum of 32 parameters can be supplied. To run a task with no parameters,
        /// call this method without any values (e.g.
        /// <code>Run()</code>
        /// ).
        /// </para>
        /// <para>
        /// The string values that you specify are paired with names and stored as name-value pairs. If you specify a single string value,
        /// then Arg0 will be the name assigned to the value. The value can be used in the task action where the $(Arg0) variable is used in
        /// the action properties.

View on GitHub (pinned to 53fb989abc)

Solutions

1. Re-register the task with TaskFolder.RegisterTaskDefinition instead of calling RegisterChanges or Update on it.
2. Change the logon type (e.g. to ServiceAccount or InteractiveToken) so no password is stored, then update normally.
3. Delete and recreate the task definition if in-place re-registration keeps failing.

When it happens

Trigger: Thrown at winPEAS/winPEASexe/winPEAS/TaskScheduler/Task.cs:1358 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/751cb103a2c0c876. Report an issue: GitHub.