Oddly named tasks in Task Scheduler revealed

The strangely named tasks are UUIDs generated by the WPScheduler DLL module of the Task Scheduler service.

The event in the event viewer corresponding to this task UUID gives the following action name where the last part of the name is a randomized UUID: 

Hi Greg,

Thanks for the reply and the info. Saw your response to the original message but had no way of contacting you as it was closed off. 

The solution to this involved deep analysis with Windbg. It's very technically involved but I decided that publishing the technical detail here was too complex for the readers here. Instead I gave a simpler answer and added the informative image in line with the images from original questioner (Big thumbs up for them as it helps people like us).

From the comments on the web it seems that before the Windows 10 anniversary edition it only appeared if using an application that used OneSync but I cannot confirm this. My PC does have Itunes installed (it's not in use) which may or may not use this but no other likely applications. 

According to the web OneDrive (which I don't use) uses OneSync for sync. If so I would expect this task to appear if this is the case unless there is some setting I don't know about.

Just in case you missed it you need to select the "Enable All Tasks History" option (When set it changes to "Disable All Task History") and wait  up to 12 hours for the task to appear in the Task Scheduler log unless one of the other triggers below is triggered. Make sure also the time period is set to "Last 24 hours" or more.

This scheduled task is set to trigger on multiple triggers (Aggregate Trigger). It triggers periodically every 12 hours  or later depending on load. It also triggers on a number of Windows Notification Facility (WNF) notifications including thermal limits, network data usage, and network (including phone) connections and disconnections. Note there is very little web information about WNF but Microsoft uses it often in its newer code.  

It would be appreciated if you can recheck the task status list once these parameters have been satisfied and write back so I can update this article accordingly.

Note I do have a way of getting the complete current task schedule list using Windbg but it is somewhat technical. I'm current looking at ways for a simple application to do this as it will be a useful security tool.

Cheers
Andy Bruin

Hi Greg,

Have some more info.

One Sync

Firstly the links you gave to OneSync are for a non Microsoft app that is unrelated to Microsoft's OneSync. Microsoft OneSync seems to be a Microsoft internal name. There is a mention of it at the following link with the relevant excerpt below

https://www.zdnet.com/article/microsoft-pushes-ahead-with-its-quest-to-make-apps-more-intelligent/ 

That team is building what Microsoft is calling OneSync, "the unified stack that supports the device platform needs of Outlook for the synchronization of People, Email, Calendar and Tasks,"

Incidently the "Unified Stack" designation probably explains the naming of the "unistack" service group which the "Sync Host" service is part of.

One Drive

After a little bit more reseach I've found that OneDrive uses a different protocol than OneSync. Seems these days it uses Microsoft Graph but I'm not 100% authoritative on this. Some more info at the following link. Ignore the confusing heading "One Sync to rule them all" as it's not refering to OneSync!

https://www.theregister.co.uk/2015/01/09/one_sync_to_rule_them_all_how_microsoft_plans_to_fix_onedrive/

ActiveSync

Microsoft OneSync uses ActiveSync as the underlying protocol. ActiveSync was also an app on Windows XP for mobile phone sync but here it refers only to the protocol used. The protocol is also called Exchange ActiveSync and some more info can be found at the following link.

https://en.wikipedia.org/wiki/Exchange_ActiveSync

This protocol is still used for syncing Outlook with mobile phones. It also is used for syncing Outlook with Microsoft Live/Outlook.com as the following link confirms.

https://answers.microsoft.com/en-us/windowslive/forum/all/does-anyone-know-what-mail-protocol-the-new/a9f4b151-3a1d-4b2e-9565-6d2d6c11ccf4

Exchange ActiveSync was also used for syncing Google mail but that seems to of been discontinued for free accounts.

https://www.zdnet.com/article/google-drops-exchange-activesync-support-for-free-email-accounts/

Exchange ActiveSync may be also used for syncing other web applications.

On my PC (which is secondhand) the only apps in use that synced were Itunes to an Ipod (although it doesn't look like ActiveSync is used for this) and a Facebook/Instagram app which may use ActiveSync.

Oddly Named Task

I've managed to examine a vanilla (No syncing apps installed or used) almost brand new PC. It seems that the task isn't running on this but I'm not 100% certain as the user has a habit of completely shutting down the computer at the end of each session (they don't believe in hibernation). 

It may be as you suspect that this task is scheduled once an application that uses ActiveSync is installed or enabled. Alternatively it may be related to the original version of Windows 10 installed.

Cheers

Andy Bruin

PS Would like to hear from you regarding whether the odd task showed up in your log.

Hi all,

Updates follow.

Oddly Named Task

Have managed to get the user with the almost new vanilla PC to run it for more than 12 hours without completely shutting down (hibernation only). The task in this case did show up and ran as soon as the PC woke up from hibernation.

Therefore this task doesn't persist over complete shutdowns unlike most other scheduled tasks but does persist if the PC is only hibernated (put to sleep).

One Sync

The "Sync Host" service is displayed as OneSyncSvc in the "Task Manager" Services tab as shown below. It is part of the "Unistack"  service group which I mentioned earlier. 

Click to expand.

Note there is plenty of info on the web about OneSyncSvc and a lot of these are dodgy websites trying to get you to download their "fix". Microsoft Windows these days has inbuilt checks to check these service files and will replace them automatically from a backup store if they don't match or if somehow you have deleted this file (just reboot and it will magically reappear). Do not under any circumstances download and install these files from these sites.

The following quote from the link following gives a good explanation of what OneSyncSvc does. Note the link pertains to disabling it but there is no will reason to do this unless you don't want devices to sync. 

The OneSyncSVC service is related to the reminders, emails, updates, to-do list, and more. Let assume that you are using Windows mobile, then whenever you make changes in To-Do list in mobile, then OneSync SVC will update PC To-Do list.

Everyone using Google mail, Yahoo mail, Microsoft mail, and more. The OneSyncSVC will update Email’s, To-Do list, Reminders, and other similar apps, which requires updates.

https://www.techwibe.com/onesyncsvc-disable-windows-10/

Oddly Named Service

Please note that OneSyncSvc is displayed as two items in the "Task Manager" Service tab. The first is just "OneSyncSvc" whilst the second is "OneSyncSvc_xxxxxx where xxxxx is a random hex number (which is 421a8 in this case) which changes on every reboot. The first is the template for the service and the second is a per user instantiation of the service. This is a change introduced with the Windows 10 version 1709. They are called "Per User" services.  In depth technical details about this at the following link.

https://docs.microsoft.com/en-us/windows/application-management/per-user-services-in-windows

Hope this helps.

Cheers

Andy Bruin

Hi Greg,

Just letting you know I have added I few comments to this thread.

Would like to talk to you privately but answers.microsoft.com has no private messaging facilities for community members. However the original thread I was responding to was cross posted to https://www.tenforums.com/general-support/141513-oddly-named-tasks-task-scheduler.html#post1920451 to which I now also have responded. Reportably tenforums.com has PM facilities though I haven't tried it. Noticed tenforums is a sister of sevenforums which you use to be highly active at.

I've also finished the app to show info about the task. Am posting the details of this in this thread.

Cheers

Andy Bruin

Hi all,

I have finished the app to reveal info about these tasks. This app has one advantage in that you don't now have to wait 12 hours after a reboot to see if such tasks are running on your computer. Plus it reveals all details about these tasks and allows you to delete them. 

More info about this at the following link.

https://www.tenforums.com/general-support/157178-hidden-task-revealer.html#post1920444

Note the reason for using another site is that once a question here is marked as solved no one can add new comment (This is fair as this site is orientated to answers). So I needed a site that could allow users to respond long term hence the move.

Cheers

Andy Bruin

More info about this at the following link.

https://www.tenforums.com/general-support/157178-hidden-task-revealer.html#post1920444

Cheers

Andy Bruin

Andy's hard work has resulted in a fully-functioning fix that has been posted in the thread he mentioned [at post #56]
GhostTaskSuppressor v1.3

The purpose of GhostTaskSuppressor is to scan for, detect & delete the immediately-preceding cog in the mechanism that initiates these ghost TS, Task status pane entries so that these ghost tasks never get created.

As Andy said, anybody interested in this issue should post in Andy's TenForums thread rather than here.

Denis