Task scheduler advanced action Filter

Question

I managed to set an action in the Task scheduler that is triggered at the validating of the network setting changes:

• by subscribing to events from the register Microsoft-Windows-Diagnostic-Networking/operative

• the only origin was Diagnostic-Networking

• now overwriting works but it fires the action 2 times

Is there a way to filter the events so that I fire the action only one time?

by adding the ID?

I tried to add number from the event viewer (6100 and 4000) but none worked

I tried to visualize the log but I couldn't find a number that worked

where can i find the ID lists that works?

Answer 1

You know when you change using the interface your static IP address in win 10, before you close, you can put a check that say "validate settings" and press ok, after Windows open another popup with a progress bar doing some checks, I managed to find those events there, but if there is another way I'm happy. Those events are diagnostic networking for the task scheduler, and apparently there are more than one

Answer 2

The "validate settings upon exit" feature launches two diagnostic sessions in succession. It is possible to distinguish the two Start events (task category ID 1) by the event data: the HelperClassName datum is first NetworkSnapshot then DnsHelperClass. To trigger on just the first Start, select the "on an event" trigger type, choose Custom in the Settings group, click Edit Event Filter, switch to the XML tab, check "edit query manually", and use this XPath query:

<QueryList>
  <Query Id="0" Path="Microsoft-Windows-Diagnostics-Networking/Operational">
    <Select Path="Microsoft-Windows-Diagnostics-Networking/Operational">*[System[Provider[@Name='Microsoft-Windows-Diagnostics-Networking'] and Task = 1]] and *[EventData[Data[@Name='HelperClassName'] and Data='NetworkSnapshot']]</Select>
  </Query>
</QueryList>