Task on Event and pass event details to task action

You can create tasks that trigger on events, export the task to XML, and then edit the XML to include ValueQueries which provide a way of passing data directly from the XML of the event details to a script. The following example is a task that triggers when a USB device is connected. It passes the ID of the USB device and the timestamp of the actual event to a script that appends the data to a log and emails an alert out.

After importing the modified script you can make changes to the task without losing the ValueQueries. Task Scheduler doesn't provide a GUI method of managing them so they stay preserved as-is. To change them you would have to export the task again, modify the XML, and re-import it.

==============Exported Task Start======================

<?xml version="1.0" encoding="UTF-16"?>

<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">

  <RegistrationInfo>

    <Date>2021-05-19T01:48:53.094776</Date>

    <Author>JOLETEC-ANDREW\Andrew Schott</Author>

    <URI>\Event Viewer Tasks\Event 2003</URI>

  </RegistrationInfo>

  <Triggers>

    <EventTrigger>

      <Enabled>true</Enabled>

      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Microsoft-Windows-DriverFrameworks-UserMode/Operational"&gt;&lt;Select Path="Microsoft-Windows-DriverFrameworks-UserMode/Operational"&gt;*[System[Provider[@Name='Microsoft-Windows-DriverFrameworks-UserMode'] and EventID=2003]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>

      <ValueQueries>

        <Value name="InstanceId">Event/UserData/UMDFHostDeviceArrivalBegin/InstanceId</Value>

        <Value name="TimeCreated">Event/System/TimeCreated/@SystemTime</Value>

      </ValueQueries>

    </EventTrigger>

  </Triggers>

  <Principals>

    <Principal id="Author">

      <UserId>S-1-5-21-2815328991-3959844506-1406902928-1001</UserId>

      <LogonType>InteractiveToken</LogonType>

      <RunLevel>LeastPrivilege</RunLevel>

    </Principal>

  </Principals>

  <Settings>

    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>

    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>

    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>

    <AllowHardTerminate>true</AllowHardTerminate>

    <StartWhenAvailable>false</StartWhenAvailable>

    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>

    <IdleSettings>

      <StopOnIdleEnd>true</StopOnIdleEnd>

      <RestartOnIdle>false</RestartOnIdle>

    </IdleSettings>

    <AllowStartOnDemand>true</AllowStartOnDemand>

    <Enabled>true</Enabled>

    <Hidden>false</Hidden>

    <RunOnlyIfIdle>false</RunOnlyIfIdle>

    <WakeToRun>false</WakeToRun>

    <ExecutionTimeLimit>PT72H</ExecutionTimeLimit>

    <Priority>7</Priority>

  </Settings>

  <Actions Context="Author">

    <Exec>

      <Command>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Command>

      <Arguments>-Command "C:\PowerShellScript.ps1" '$(InstanceId)' '$(TimeCreated)'</Arguments>

    </Exec>

  </Actions>

</Task>

==============Exported Task End======================

==============Powershell Script Start======================

filter timestamp {"$(Get-Date -Format G): $_"}

$value = "$env:USERNAME - USB Connected - $args" | timestamp

Add-Content -Path "C:\Users\Andrew Schott\Desktop\Alert.log" -Value $value

Send-MailMessage -To 'andrew@joletec.com','dylan@joletec.com' -From 'alert@frankenmuthpd.com' -SmtpServer 'iis.joletec.com' -Subject 'FPD USB Alert' -Body $value -Attachments 'C:\Alert.log'

==============Powershell Script End======================