bastion universalis

officia :: windows task scheduler dossier

tabula officiorum :: sealed

self-contained dossier of every windows scheduled task on this workstation. triggers, actions, conditions and principals captured for audit, restoration and offsite review.

12 Jun 2026, 19:58
operator :: alfonso
node :: terra-sd-01
scheduler :: windows v1.4
stamp :: 2026-06-13T01:58:09.073Z
:: 01 :: tasks
16
registered in scheduler tree
:: 02 :: ready
13
armed :: awaiting trigger
:: 03 :: disabled / queued
2
manual hold or waiting
:: 04 :: failed
1
last result non-zero
:::: 05 :::: scheduler overview

tabular dispatch :: full set

16 entries :: read-only
idnamepathtriggerstartrun asnext runlast resultstatus
001 system update scan \bastion\officia\updates\ daily 03:00 system 13 Jun 2026, 03:00 0x0 ready
002 defender quick scan \bastion\officia\security\ daily 02:00 system 13 Jun 2026, 02:00 0x0 ready
003 documents mirror \bastion\officia\backup\ daily 23:00 alfonso 12 Jun 2026, 23:00 0x0 ready
004 disk cleanup \bastion\officia\maintenance\ weekly 04:30 alfonso 15 Jun 2026, 04:30 0x0 ready
005 ssd trim optimize \bastion\officia\maintenance\ weekly 05:00 system 14 Jun 2026, 05:00 0x0 ready
006 cloud vault sync \bastion\officia\backup\ on logon 08:00 alfonso 13 Jun 2026, 08:00 0x0 ready
007 network probe \bastion\officia\network\ daily 07:00 alfonso 13 Jun 2026, 07:00 0x0 running
008 dns cache flush \bastion\officia\network\ weekly 06:00 alfonso 17 Jun 2026, 06:00 0x0 disabled
009 defender full scan \bastion\officia\security\ weekly 01:00 system 16 Jun 2026, 01:00 0x0 ready
010 credit due notice \bastion\officia\personal\ monthly 09:00 alfonso 19 Jun 2026, 09:00 0x0 ready
011 pointer driver reset \bastion\officia\system\ on boot 00:00 system 13 Jun 2026, 12:00 0x0 ready
012 security event export \bastion\officia\security\ weekly 23:30 system 18 Jun 2026, 23:30 0x0 ready
013 chipset driver scan \bastion\officia\updates\ monthly 10:00 alfonso 22 Jun 2026, 10:00 0x800704c7 failed
014 log rotation \bastion\officia\maintenance\ monthly 04:00 alfonso 24 Jun 2026, 04:00 0x0 ready
015 idle workstation hibernate \bastion\officia\system\ on idle 00:00 alfonso 12 Jun 2026, 23:30 0x0 queued
016 event 6008 watchdog \bastion\officia\security\ on event 00:00 system 14 Jun 2026, 00:00 0x0 ready
:::: 06 :::: dossier

task cards :: full configuration

trigger • action • conditions • settings
:: 001 :: upd :: t-001 ready

system update scan

\bastion\officia\updates\system_update_scan

keep the workstation aligned with the latest security baseline.

:: 01 :: trigger
daily
:: 02 :: start time
03:00
:: 03 :: run as
system :: highest
:: 04 :: class
updates
:: 05 :: next run
13 Jun 2026, 03:00
:: 06 :: last run
12 Jun 2026, 03:00
:: 07 :: last result
0x0
:: 08 :: schedule
daily @ 03:00
:: 09 :: program / script c:\windows\system32\sc.exe
:: 10 :: arguments start wuauserv
:: 11 :: start in c:\windows\system32
wake to runoff
ac power onlyon
network requiredon
idle requiredoff
on demandon
hiddenoff
:: 12 :: schtasks.exe 
schtasks /create \
    /tn "\bastion\officia\updates\system_update_scan" \
    /tr "\"c:\windows\system32\sc.exe\" start wuauserv".trim() \
    /sc daily \
    /st 03:00 \
    /ru "system" \
    /rl highest \
    /f
:: 13 :: notes

critical for security posture. do not disable.

:: 002 :: sec :: t-002 ready

defender quick scan

\bastion\officia\security\defender_quick_scan

detect malware in high-risk paths every 24h.

:: 01 :: trigger
daily
:: 02 :: start time
02:00
:: 03 :: run as
system :: highest
:: 04 :: class
security
:: 05 :: next run
13 Jun 2026, 02:00
:: 06 :: last run
12 Jun 2026, 02:00
:: 07 :: last result
0x0
:: 08 :: schedule
daily @ 02:00
:: 09 :: program / script c:\programdata\microsoft\windows defender\platform\mpcmdrun.exe
:: 10 :: arguments -scan -scantype 1
:: 11 :: start in c:\windows\system32
wake to runoff
ac power onlyon
network requiredon
idle requiredoff
on demandon
hiddenoff
:: 12 :: schtasks.exe 
schtasks /create \
    /tn "\bastion\officia\security\defender_quick_scan" \
    /tr "\"c:\programdata\microsoft\windows defender\platform\mpcmdrun.exe\" -scan -scantype 1".trim() \
    /sc daily \
    /st 02:00 \
    /ru "system" \
    /rl highest \
    /f
:: 13 :: notes

full scan delegated to weekly schedule.

:: 003 :: bkp :: t-003 ready

documents mirror

\bastion\officia\backup\documents_mirror

protect critical files against accidental loss.

:: 01 :: trigger
daily
:: 02 :: start time
23:00
:: 03 :: run as
alfonso
:: 04 :: class
backup
:: 05 :: next run
12 Jun 2026, 23:00
:: 06 :: last run
11 Jun 2026, 23:00
:: 07 :: last result
0x0
:: 08 :: schedule
daily @ 23:00
:: 09 :: program / script c:\windows\system32\robocopy.exe
:: 10 :: arguments LOCAL_USER_PATH_REDACTED\alfonso\documents d:\backups\documents /mir /xo /r:3 /w:5
:: 11 :: start in c:\windows\system32
wake to runon
ac power onlyoff
network requiredon
idle requiredoff
on demandon
hiddenoff
:: 12 :: schtasks.exe 
schtasks /create \
    /tn "\bastion\officia\backup\documents_mirror" \
    /tr "\"c:\windows\system32\robocopy.exe\" LOCAL_USER_PATH_REDACTED\alfonso\documents d:\backups\documents /mir /xo /r:3 /w:5".trim() \
    /sc daily \
    /st 23:00 \
    /ru "alfonso" \
    /f
:: 13 :: notes

audit free space on d: monthly.

:: 004 :: mnt :: t-004 ready

disk cleanup

\bastion\officia\maintenance\disk_cleanup

reclaim disk space and improve runtime performance.

:: 01 :: trigger
weekly
:: 02 :: start time
04:30
:: 03 :: run as
alfonso :: highest
:: 04 :: class
maintenance
:: 05 :: next run
15 Jun 2026, 04:30
:: 06 :: last run
8 Jun 2026, 04:30
:: 07 :: last result
0x0
:: 08 :: schedule
weekly :: sun @ 04:30
:: 09 :: program / script c:\windows\system32\cleanmgr.exe
:: 10 :: arguments /sagerun:1
:: 11 :: start in c:\windows\system32
wake to runoff
ac power onlyon
network requiredon
idle requiredoff
on demandon
hiddenoff
:: 12 :: schtasks.exe 
schtasks /create \
    /tn "\bastion\officia\maintenance\disk_cleanup" \
    /tr "\"c:\windows\system32\cleanmgr.exe\" /sagerun:1".trim() \
    /sc weekly \
    /st 04:30 \
    /d sun \
    /ru "alfonso" \
    /rl highest \
    /f
:: 13 :: notes

clears temp, recycle bin and browser caches.

:: 005 :: mnt :: t-005 ready

ssd trim optimize

\bastion\officia\maintenance\ssd_trim_optimize

run trim against the ssd to maintain peak throughput.

:: 01 :: trigger
weekly
:: 02 :: start time
05:00
:: 03 :: run as
system :: highest
:: 04 :: class
maintenance
:: 05 :: next run
14 Jun 2026, 05:00
:: 06 :: last run
7 Jun 2026, 05:00
:: 07 :: last result
0x0
:: 08 :: schedule
weekly :: sat @ 05:00
:: 09 :: program / script c:\windows\system32\defrag.exe
:: 10 :: arguments c: /o
:: 11 :: start in c:\windows\system32
wake to runoff
ac power onlyon
network requiredon
idle requiredoff
on demandon
hiddenoff
:: 12 :: schtasks.exe 
schtasks /create \
    /tn "\bastion\officia\maintenance\ssd_trim_optimize" \
    /tr "\"c:\windows\system32\defrag.exe\" c: /o".trim() \
    /sc weekly \
    /st 05:00 \
    /d sat \
    /ru "system" \
    /rl highest \
    /f
:: 13 :: notes

trim only, no legacy defrag on ssd.

:: 006 :: bkp :: t-006 ready

cloud vault sync

\bastion\officia\backup\cloud_vault_sync

ensure files are mirrored offsite as soon as session begins.

:: 01 :: trigger
on logon
:: 02 :: start time
08:00
:: 03 :: run as
alfonso
:: 04 :: class
backup
:: 05 :: next run
13 Jun 2026, 08:00
:: 06 :: last run
12 Jun 2026, 08:00
:: 07 :: last result
0x0
:: 08 :: schedule
at logon :: alfonso
:: 09 :: program / script c:\program files\cloudvault\cloudvault.exe
:: 10 :: arguments /background
:: 11 :: start in c:\windows\system32
wake to runoff
ac power onlyon
network requiredon
idle requiredoff
on demandon
hiddenoff
:: 12 :: schtasks.exe 
schtasks /create \
    /tn "\bastion\officia\backup\cloud_vault_sync" \
    /tr "\"c:\program files\cloudvault\cloudvault.exe\" /background".trim() \
    /sc onlogon \
    /ru "alfonso" \
    /f
:: 13 :: notes

runs automatically at session start.

:: 007 :: net :: t-007 running

network probe

\bastion\officia\network\network_probe

proactively detect connectivity degradation.

:: 01 :: trigger
daily
:: 02 :: start time
07:00
:: 03 :: run as
alfonso
:: 04 :: class
network
:: 05 :: next run
13 Jun 2026, 07:00
:: 06 :: last run
12 Jun 2026, 07:00
:: 07 :: last result
0x0
:: 08 :: schedule
daily @ 07:00
:: 09 :: program / script c:\windows\system32\cmd.exe
:: 10 :: arguments /c ping -n 4 8.8.8.8 >> c:\logs\net.log && ping -n 4 1.1.1.1 >> c:\logs\net.log
:: 11 :: start in c:\windows\system32
wake to runoff
ac power onlyon
network requiredon
idle requiredoff
on demandon
hiddenoff
:: 12 :: schtasks.exe 
schtasks /create \
    /tn "\bastion\officia\network\network_probe" \
    /tr "\"c:\windows\system32\cmd.exe\" /c ping -n 4 8.8.8.8 >> c:\logs\net.log && ping -n 4 1.1.1.1 >> c:\logs\net.log".trim() \
    /sc daily \
    /st 07:00 \
    /ru "alfonso" \
    /f
:: 13 :: notes

output logged to c:\logs\net.log

:: 008 :: net :: t-008 disabled

dns cache flush

\bastion\officia\network\dns_cache_flush

avoid stale name resolution issues across sessions.

:: 01 :: trigger
weekly
:: 02 :: start time
06:00
:: 03 :: run as
alfonso :: highest
:: 04 :: class
network
:: 05 :: next run
17 Jun 2026, 06:00
:: 06 :: last run
5 Jun 2026, 06:00
:: 07 :: last result
0x0
:: 08 :: schedule
weekly :: mon @ 06:00
:: 09 :: program / script c:\windows\system32\ipconfig.exe
:: 10 :: arguments /flushdns
:: 11 :: start in c:\windows\system32
wake to runoff
ac power onlyon
network requiredon
idle requiredoff
on demandon
hiddenoff
:: 12 :: schtasks.exe 
schtasks /create \
    /tn "\bastion\officia\network\dns_cache_flush" \
    /tr "\"c:\windows\system32\ipconfig.exe\" /flushdns".trim() \
    /sc weekly \
    /st 06:00 \
    /d mon \
    /ru "alfonso" \
    /rl highest \
    /f
:: 13 :: notes

paused while validating new router profile.

:: 009 :: sec :: t-009 ready

defender full scan

\bastion\officia\security\defender_full_scan

hunt persistent threats and dormant payloads.

:: 01 :: trigger
weekly
:: 02 :: start time
01:00
:: 03 :: run as
system :: highest
:: 04 :: class
security
:: 05 :: next run
16 Jun 2026, 01:00
:: 06 :: last run
9 Jun 2026, 01:00
:: 07 :: last result
0x0
:: 08 :: schedule
weekly :: sun @ 01:00
:: 09 :: program / script c:\programdata\microsoft\windows defender\platform\mpcmdrun.exe
:: 10 :: arguments -scan -scantype 2
:: 11 :: start in c:\windows\system32
wake to runoff
ac power onlyon
network requiredon
idle requiredoff
on demandon
hiddenoff
:: 12 :: schtasks.exe 
schtasks /create \
    /tn "\bastion\officia\security\defender_full_scan" \
    /tr "\"c:\programdata\microsoft\windows defender\platform\mpcmdrun.exe\" -scan -scantype 2".trim() \
    /sc weekly \
    /st 01:00 \
    /d sun \
    /ru "system" \
    /rl highest \
    /f
:: 13 :: notes

runs sunday before dawn. duration 2-3h.

:: 010 :: usr :: t-010 ready

credit due notice

\bastion\officia\personal\credit_due_notice

avoid late payment charges on revolving credit account.

:: 01 :: trigger
monthly
:: 02 :: start time
09:00
:: 03 :: run as
alfonso
:: 04 :: class
personal
:: 05 :: next run
19 Jun 2026, 09:00
:: 06 :: last run
20 May 2026, 09:00
:: 07 :: last result
0x0
:: 08 :: schedule
monthly :: day 15 @ 09:00
:: 09 :: program / script c:\windows\system32\msg.exe
:: 10 :: arguments %username% "credit account due today"
:: 11 :: start in c:\windows\system32
wake to runoff
ac power onlyon
network requiredon
idle requiredoff
on demandon
hiddenoff
:: 12 :: schtasks.exe 
schtasks /create \
    /tn "\bastion\officia\personal\credit_due_notice" \
    /tr "\"c:\windows\system32\msg.exe\" %username% "credit account due today"".trim() \
    /sc monthly \
    /st 09:00 \
    /d 15 \
    /ru "alfonso" \
    /f
:: 13 :: notes

configured for day 15 of every month.

:: 011 :: sys :: t-011 ready

pointer driver reset

\bastion\officia\system\pointer_driver_reset

mitigate intermittent input freezes on resume.

:: 01 :: trigger
on boot
:: 02 :: start time
00:00
:: 03 :: run as
system :: highest
:: 04 :: class
system
:: 05 :: next run
13 Jun 2026, 12:00
:: 06 :: last run
12 Jun 2026, 12:00
:: 07 :: last result
0x0
:: 08 :: schedule
at system startup
:: 09 :: program / script c:\windows\system32\cmd.exe
:: 10 :: arguments /c net stop syntpenhservice && net start syntpenhservice
:: 11 :: start in c:\windows\system32
wake to runoff
ac power onlyon
network requiredon
idle requiredoff
on demandon
hiddenoff
:: 12 :: schtasks.exe 
schtasks /create \
    /tn "\bastion\officia\system\pointer_driver_reset" \
    /tr "\"c:\windows\system32\cmd.exe\" /c net stop syntpenhservice && net start syntpenhservice".trim() \
    /sc onstart \
    /ru "system" \
    /rl highest \
    /f
:: 13 :: notes

temporary workaround pending driver update.

:: 012 :: sec :: t-012 ready

security event export

\bastion\officia\security\security_event_export

maintain auditable record of critical system events.

:: 01 :: trigger
weekly
:: 02 :: start time
23:30
:: 03 :: run as
system :: highest
:: 04 :: class
security
:: 05 :: next run
18 Jun 2026, 23:30
:: 06 :: last run
11 Jun 2026, 23:30
:: 07 :: last result
0x0
:: 08 :: schedule
weekly :: fri @ 23:30
:: 09 :: program / script c:\windows\system32\wevtutil.exe
:: 10 :: arguments epl security c:\logs\security_%date%.evtx
:: 11 :: start in c:\windows\system32
wake to runoff
ac power onlyon
network requiredon
idle requiredoff
on demandon
hiddenoff
:: 12 :: schtasks.exe 
schtasks /create \
    /tn "\bastion\officia\security\security_event_export" \
    /tr "\"c:\windows\system32\wevtutil.exe\" epl security c:\logs\security_%date%.evtx".trim() \
    /sc weekly \
    /st 23:30 \
    /d fri \
    /ru "system" \
    /rl highest \
    /f
:: 13 :: notes

retain logs for 90 days minimum.

:: 013 :: upd :: t-013 failed

chipset driver scan

\bastion\officia\updates\chipset_driver_scan

maintain hardware controller stability over time.

:: 01 :: trigger
monthly
:: 02 :: start time
10:00
:: 03 :: run as
alfonso :: highest
:: 04 :: class
updates
:: 05 :: next run
22 Jun 2026, 10:00
:: 06 :: last run
23 May 2026, 10:00
:: 07 :: last result
0x800704c7
:: 08 :: schedule
monthly :: day 1 @ 10:00
:: 09 :: program / script c:\windows\system32\pnputil.exe
:: 10 :: arguments /scan-devices
:: 11 :: start in c:\windows\system32
wake to runoff
ac power onlyon
network requiredon
idle requiredoff
on demandon
hiddenoff
:: 12 :: schtasks.exe 
schtasks /create \
    /tn "\bastion\officia\updates\chipset_driver_scan" \
    /tr "\"c:\windows\system32\pnputil.exe\" /scan-devices".trim() \
    /sc monthly \
    /st 10:00 \
    /d 1 \
    /ru "alfonso" \
    /rl highest \
    /f
:: 13 :: notes

last run failed :: check elevated permissions.

:: 014 :: mnt :: t-014 ready

log rotation

\bastion\officia\maintenance\log_rotation

prevent log directory bloat across volumes.

:: 01 :: trigger
monthly
:: 02 :: start time
04:00
:: 03 :: run as
alfonso
:: 04 :: class
maintenance
:: 05 :: next run
24 Jun 2026, 04:00
:: 06 :: last run
25 May 2026, 04:00
:: 07 :: last result
0x0
:: 08 :: schedule
monthly :: day 1 @ 04:00
:: 09 :: program / script c:\windows\system32\forfiles.exe
:: 10 :: arguments /p c:\logs /s /m *.log /d -30 /c "cmd /c del @path"
:: 11 :: start in c:\windows\system32
wake to runoff
ac power onlyon
network requiredon
idle requiredoff
on demandon
hiddenoff
:: 12 :: schtasks.exe 
schtasks /create \
    /tn "\bastion\officia\maintenance\log_rotation" \
    /tr "\"c:\windows\system32\forfiles.exe\" /p c:\logs /s /m *.log /d -30 /c "cmd /c del @path"".trim() \
    /sc monthly \
    /st 04:00 \
    /d 1 \
    /ru "alfonso" \
    /f
:: 13 :: notes

retain only recent operational logs.

:: 015 :: sys :: t-015 queued

idle workstation hibernate

\bastion\officia\system\idle_workstation_hibernate

reduce power draw when the workstation is unattended.

:: 01 :: trigger
on idle
:: 02 :: start time
00:00
:: 03 :: run as
alfonso
:: 04 :: class
system
:: 05 :: next run
12 Jun 2026, 23:30
:: 06 :: last run
11 Jun 2026, 23:00
:: 07 :: last result
0x0
:: 08 :: schedule
on idle :: after 30 min
:: 09 :: program / script c:\windows\system32\shutdown.exe
:: 10 :: arguments /h
:: 11 :: start in c:\windows\system32
wake to runoff
ac power onlyoff
network requiredon
idle requiredon
on demandon
hiddenoff
:: 12 :: schtasks.exe 
schtasks /create \
    /tn "\bastion\officia\system\idle_workstation_hibernate" \
    /tr "\"c:\windows\system32\shutdown.exe\" /h".trim() \
    /sc onidle \
    /i 30 \
    /ru "alfonso" \
    /f
:: 13 :: notes

fires after 30 min of inactivity.

:: 016 :: sec :: t-016 ready

event 6008 watchdog

\bastion\officia\security\event_6008_watchdog

react to unexpected shutdown events captured in the system log.

:: 01 :: trigger
on event
:: 02 :: start time
00:00
:: 03 :: run as
system :: highest
:: 04 :: class
security
:: 05 :: next run
14 Jun 2026, 00:00
:: 06 :: last run
3 Jun 2026, 04:12
:: 07 :: last result
0x0
:: 08 :: schedule
on event :: system :: id 6008
:: 09 :: program / script c:\windows\system32\powershell.exe
:: 10 :: arguments -noprofile -file c:\bastion\scripts\notify-incident.ps1
:: 11 :: start in c:\windows\system32
wake to runoff
ac power onlyon
network requiredon
idle requiredoff
on demandon
hiddenoff
:: 12 :: schtasks.exe 
schtasks /create \
    /tn "\bastion\officia\security\event_6008_watchdog" \
    /tr "\"c:\windows\system32\powershell.exe\" -noprofile -file c:\bastion\scripts\notify-incident.ps1".trim() \
    /sc onevent \
    /ec system \
    /mo 6008 \
    /ru "system" \
    /rl highest \
    /f
:: 13 :: notes

fires whenever event id 6008 is written to the system channel.

:::: 07 :::: restoration payload

task definition :: xml per task

schtasks /create /xml — portable
:: t-001 :: system update scan \bastion\officia\updates\ 
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2026-06-13T01:58:09.078Z</Date>
    <Author>system</Author>
    <Description>keep the workstation aligned with the latest security baseline.</Description>
    <URI>\bastion\officia\updates\system_update_scan</URI>
  </RegistrationInfo>
  <Triggers>
    <CalendarTrigger><StartBoundary>2026-06-13T09:00:00.000Z</StartBoundary><Enabled>true</Enabled><ScheduleByDay><DaysInterval>1</DaysInterval></ScheduleByDay></CalendarTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>system</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <WakeToRun>false</WakeToRun>
    <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <IdleSettings><Duration>PT10M</Duration><WaitTimeout>PT1H</WaitTimeout></IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <ExecutionTimeLimit>PT01H</ExecutionTimeLimit>
    <RestartCount>3</RestartCount>
    <RestartInterval>PT1M</RestartInterval>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>c:\windows\system32\sc.exe</Command>
      <Arguments>start wuauserv</Arguments>
      <WorkingDirectory>c:\windows\system32</WorkingDirectory>
    </Exec>
  </Actions>
</Task>
:: t-002 :: defender quick scan \bastion\officia\security\ 
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2026-06-13T01:58:09.078Z</Date>
    <Author>system</Author>
    <Description>detect malware in high-risk paths every 24h.</Description>
    <URI>\bastion\officia\security\defender_quick_scan</URI>
  </RegistrationInfo>
  <Triggers>
    <CalendarTrigger><StartBoundary>2026-06-13T08:00:00.000Z</StartBoundary><Enabled>true</Enabled><ScheduleByDay><DaysInterval>1</DaysInterval></ScheduleByDay></CalendarTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>system</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <WakeToRun>false</WakeToRun>
    <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <IdleSettings><Duration>PT10M</Duration><WaitTimeout>PT1H</WaitTimeout></IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <ExecutionTimeLimit>PT01H</ExecutionTimeLimit>
    <RestartCount>3</RestartCount>
    <RestartInterval>PT1M</RestartInterval>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>c:\programdata\microsoft\windows defender\platform\mpcmdrun.exe</Command>
      <Arguments>-scan -scantype 1</Arguments>
      <WorkingDirectory>c:\windows\system32</WorkingDirectory>
    </Exec>
  </Actions>
</Task>
:: t-003 :: documents mirror \bastion\officia\backup\ 
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2026-06-13T01:58:09.078Z</Date>
    <Author>alfonso</Author>
    <Description>protect critical files against accidental loss.</Description>
    <URI>\bastion\officia\backup\documents_mirror</URI>
  </RegistrationInfo>
  <Triggers>
    <CalendarTrigger><StartBoundary>2026-06-13T05:00:00.000Z</StartBoundary><Enabled>true</Enabled><ScheduleByDay><DaysInterval>1</DaysInterval></ScheduleByDay></CalendarTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>alfonso</UserId>
      <RunLevel>LeastPrivilege</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
    <WakeToRun>true</WakeToRun>
    <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <IdleSettings><Duration>PT10M</Duration><WaitTimeout>PT1H</WaitTimeout></IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <ExecutionTimeLimit>PT01H</ExecutionTimeLimit>
    <RestartCount>3</RestartCount>
    <RestartInterval>PT1M</RestartInterval>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>c:\windows\system32\robocopy.exe</Command>
      <Arguments>LOCAL_USER_PATH_REDACTED\alfonso\documents d:\backups\documents /mir /xo /r:3 /w:5</Arguments>
      <WorkingDirectory>c:\windows\system32</WorkingDirectory>
    </Exec>
  </Actions>
</Task>
:: t-004 :: disk cleanup \bastion\officia\maintenance\ 
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2026-06-13T01:58:09.078Z</Date>
    <Author>alfonso</Author>
    <Description>reclaim disk space and improve runtime performance.</Description>
    <URI>\bastion\officia\maintenance\disk_cleanup</URI>
  </RegistrationInfo>
  <Triggers>
    <CalendarTrigger><StartBoundary>2026-06-15T10:30:00.000Z</StartBoundary><Enabled>true</Enabled><ScheduleByWeek><DaysOfWeek><Sun /></DaysOfWeek><WeeksInterval>1</WeeksInterval></ScheduleByWeek></CalendarTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>alfonso</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <WakeToRun>false</WakeToRun>
    <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <IdleSettings><Duration>PT10M</Duration><WaitTimeout>PT1H</WaitTimeout></IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <ExecutionTimeLimit>PT01H</ExecutionTimeLimit>
    <RestartCount>3</RestartCount>
    <RestartInterval>PT1M</RestartInterval>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>c:\windows\system32\cleanmgr.exe</Command>
      <Arguments>/sagerun:1</Arguments>
      <WorkingDirectory>c:\windows\system32</WorkingDirectory>
    </Exec>
  </Actions>
</Task>
:: t-005 :: ssd trim optimize \bastion\officia\maintenance\ 
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2026-06-13T01:58:09.078Z</Date>
    <Author>system</Author>
    <Description>run trim against the ssd to maintain peak throughput.</Description>
    <URI>\bastion\officia\maintenance\ssd_trim_optimize</URI>
  </RegistrationInfo>
  <Triggers>
    <CalendarTrigger><StartBoundary>2026-06-14T11:00:00.000Z</StartBoundary><Enabled>true</Enabled><ScheduleByWeek><DaysOfWeek><Sat /></DaysOfWeek><WeeksInterval>1</WeeksInterval></ScheduleByWeek></CalendarTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>system</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <WakeToRun>false</WakeToRun>
    <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <IdleSettings><Duration>PT10M</Duration><WaitTimeout>PT1H</WaitTimeout></IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <ExecutionTimeLimit>PT01H</ExecutionTimeLimit>
    <RestartCount>3</RestartCount>
    <RestartInterval>PT1M</RestartInterval>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>c:\windows\system32\defrag.exe</Command>
      <Arguments>c: /o</Arguments>
      <WorkingDirectory>c:\windows\system32</WorkingDirectory>
    </Exec>
  </Actions>
</Task>
:: t-006 :: cloud vault sync \bastion\officia\backup\ 
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2026-06-13T01:58:09.078Z</Date>
    <Author>alfonso</Author>
    <Description>ensure files are mirrored offsite as soon as session begins.</Description>
    <URI>\bastion\officia\backup\cloud_vault_sync</URI>
  </RegistrationInfo>
  <Triggers>
    <LogonTrigger><Enabled>true</Enabled><UserId>alfonso</UserId></LogonTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>alfonso</UserId>
      <RunLevel>LeastPrivilege</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <WakeToRun>false</WakeToRun>
    <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <IdleSettings><Duration>PT10M</Duration><WaitTimeout>PT1H</WaitTimeout></IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <ExecutionTimeLimit>PT01H</ExecutionTimeLimit>
    <RestartCount>3</RestartCount>
    <RestartInterval>PT1M</RestartInterval>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>c:\program files\cloudvault\cloudvault.exe</Command>
      <Arguments>/background</Arguments>
      <WorkingDirectory>c:\windows\system32</WorkingDirectory>
    </Exec>
  </Actions>
</Task>
:: t-007 :: network probe \bastion\officia\network\ 
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2026-06-13T01:58:09.078Z</Date>
    <Author>alfonso</Author>
    <Description>proactively detect connectivity degradation.</Description>
    <URI>\bastion\officia\network\network_probe</URI>
  </RegistrationInfo>
  <Triggers>
    <CalendarTrigger><StartBoundary>2026-06-13T13:00:00.000Z</StartBoundary><Enabled>true</Enabled><ScheduleByDay><DaysInterval>1</DaysInterval></ScheduleByDay></CalendarTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>alfonso</UserId>
      <RunLevel>LeastPrivilege</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <WakeToRun>false</WakeToRun>
    <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <IdleSettings><Duration>PT10M</Duration><WaitTimeout>PT1H</WaitTimeout></IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <ExecutionTimeLimit>PT01H</ExecutionTimeLimit>
    <RestartCount>3</RestartCount>
    <RestartInterval>PT1M</RestartInterval>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>c:\windows\system32\cmd.exe</Command>
      <Arguments>/c ping -n 4 8.8.8.8 >> c:\logs\net.log && ping -n 4 1.1.1.1 >> c:\logs\net.log</Arguments>
      <WorkingDirectory>c:\windows\system32</WorkingDirectory>
    </Exec>
  </Actions>
</Task>
:: t-008 :: dns cache flush \bastion\officia\network\ 
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2026-06-13T01:58:09.078Z</Date>
    <Author>alfonso</Author>
    <Description>avoid stale name resolution issues across sessions.</Description>
    <URI>\bastion\officia\network\dns_cache_flush</URI>
  </RegistrationInfo>
  <Triggers>
    <CalendarTrigger><StartBoundary>2026-06-17T12:00:00.000Z</StartBoundary><Enabled>true</Enabled><ScheduleByWeek><DaysOfWeek><Mon /></DaysOfWeek><WeeksInterval>1</WeeksInterval></ScheduleByWeek></CalendarTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>alfonso</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <WakeToRun>false</WakeToRun>
    <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <IdleSettings><Duration>PT10M</Duration><WaitTimeout>PT1H</WaitTimeout></IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>false</Enabled>
    <Hidden>false</Hidden>
    <ExecutionTimeLimit>PT01H</ExecutionTimeLimit>
    <RestartCount>3</RestartCount>
    <RestartInterval>PT1M</RestartInterval>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>c:\windows\system32\ipconfig.exe</Command>
      <Arguments>/flushdns</Arguments>
      <WorkingDirectory>c:\windows\system32</WorkingDirectory>
    </Exec>
  </Actions>
</Task>
:: t-009 :: defender full scan \bastion\officia\security\ 
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2026-06-13T01:58:09.078Z</Date>
    <Author>system</Author>
    <Description>hunt persistent threats and dormant payloads.</Description>
    <URI>\bastion\officia\security\defender_full_scan</URI>
  </RegistrationInfo>
  <Triggers>
    <CalendarTrigger><StartBoundary>2026-06-16T07:00:00.000Z</StartBoundary><Enabled>true</Enabled><ScheduleByWeek><DaysOfWeek><Sun /></DaysOfWeek><WeeksInterval>1</WeeksInterval></ScheduleByWeek></CalendarTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>system</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <WakeToRun>false</WakeToRun>
    <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <IdleSettings><Duration>PT10M</Duration><WaitTimeout>PT1H</WaitTimeout></IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <ExecutionTimeLimit>PT04H</ExecutionTimeLimit>
    <RestartCount>3</RestartCount>
    <RestartInterval>PT1M</RestartInterval>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>c:\programdata\microsoft\windows defender\platform\mpcmdrun.exe</Command>
      <Arguments>-scan -scantype 2</Arguments>
      <WorkingDirectory>c:\windows\system32</WorkingDirectory>
    </Exec>
  </Actions>
</Task>
:: t-010 :: credit due notice \bastion\officia\personal\ 
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2026-06-13T01:58:09.078Z</Date>
    <Author>alfonso</Author>
    <Description>avoid late payment charges on revolving credit account.</Description>
    <URI>\bastion\officia\personal\credit_due_notice</URI>
  </RegistrationInfo>
  <Triggers>
    <CalendarTrigger><StartBoundary>2026-06-19T15:00:00.000Z</StartBoundary><Enabled>true</Enabled><ScheduleByMonth><DaysOfMonth><Day>15</Day></DaysOfMonth><Months><January /><February /><March /><April /><May /><June /><July /><August /><September /><October /><November /><December /></Months></ScheduleByMonth></CalendarTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>alfonso</UserId>
      <RunLevel>LeastPrivilege</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <WakeToRun>false</WakeToRun>
    <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <IdleSettings><Duration>PT10M</Duration><WaitTimeout>PT1H</WaitTimeout></IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <ExecutionTimeLimit>PT01H</ExecutionTimeLimit>
    <RestartCount>3</RestartCount>
    <RestartInterval>PT1M</RestartInterval>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>c:\windows\system32\msg.exe</Command>
      <Arguments>%username% "credit account due today"</Arguments>
      <WorkingDirectory>c:\windows\system32</WorkingDirectory>
    </Exec>
  </Actions>
</Task>
:: t-011 :: pointer driver reset \bastion\officia\system\ 
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2026-06-13T01:58:09.078Z</Date>
    <Author>system</Author>
    <Description>mitigate intermittent input freezes on resume.</Description>
    <URI>\bastion\officia\system\pointer_driver_reset</URI>
  </RegistrationInfo>
  <Triggers>
    <BootTrigger><Enabled>true</Enabled></BootTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>system</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <WakeToRun>false</WakeToRun>
    <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <IdleSettings><Duration>PT10M</Duration><WaitTimeout>PT1H</WaitTimeout></IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <ExecutionTimeLimit>PT01H</ExecutionTimeLimit>
    <RestartCount>3</RestartCount>
    <RestartInterval>PT1M</RestartInterval>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>c:\windows\system32\cmd.exe</Command>
      <Arguments>/c net stop syntpenhservice && net start syntpenhservice</Arguments>
      <WorkingDirectory>c:\windows\system32</WorkingDirectory>
    </Exec>
  </Actions>
</Task>
:: t-012 :: security event export \bastion\officia\security\ 
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2026-06-13T01:58:09.078Z</Date>
    <Author>system</Author>
    <Description>maintain auditable record of critical system events.</Description>
    <URI>\bastion\officia\security\security_event_export</URI>
  </RegistrationInfo>
  <Triggers>
    <CalendarTrigger><StartBoundary>2026-06-19T05:30:00.000Z</StartBoundary><Enabled>true</Enabled><ScheduleByWeek><DaysOfWeek><Fri /></DaysOfWeek><WeeksInterval>1</WeeksInterval></ScheduleByWeek></CalendarTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>system</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <WakeToRun>false</WakeToRun>
    <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <IdleSettings><Duration>PT10M</Duration><WaitTimeout>PT1H</WaitTimeout></IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <ExecutionTimeLimit>PT01H</ExecutionTimeLimit>
    <RestartCount>3</RestartCount>
    <RestartInterval>PT1M</RestartInterval>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>c:\windows\system32\wevtutil.exe</Command>
      <Arguments>epl security c:\logs\security_%date%.evtx</Arguments>
      <WorkingDirectory>c:\windows\system32</WorkingDirectory>
    </Exec>
  </Actions>
</Task>
:: t-013 :: chipset driver scan \bastion\officia\updates\ 
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2026-06-13T01:58:09.078Z</Date>
    <Author>alfonso</Author>
    <Description>maintain hardware controller stability over time.</Description>
    <URI>\bastion\officia\updates\chipset_driver_scan</URI>
  </RegistrationInfo>
  <Triggers>
    <CalendarTrigger><StartBoundary>2026-06-22T16:00:00.000Z</StartBoundary><Enabled>true</Enabled><ScheduleByMonth><DaysOfMonth><Day>1</Day></DaysOfMonth><Months><January /><February /><March /><April /><May /><June /><July /><August /><September /><October /><November /><December /></Months></ScheduleByMonth></CalendarTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>alfonso</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <WakeToRun>false</WakeToRun>
    <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <IdleSettings><Duration>PT10M</Duration><WaitTimeout>PT1H</WaitTimeout></IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <ExecutionTimeLimit>PT01H</ExecutionTimeLimit>
    <RestartCount>3</RestartCount>
    <RestartInterval>PT1M</RestartInterval>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>c:\windows\system32\pnputil.exe</Command>
      <Arguments>/scan-devices</Arguments>
      <WorkingDirectory>c:\windows\system32</WorkingDirectory>
    </Exec>
  </Actions>
</Task>
:: t-014 :: log rotation \bastion\officia\maintenance\ 
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2026-06-13T01:58:09.078Z</Date>
    <Author>alfonso</Author>
    <Description>prevent log directory bloat across volumes.</Description>
    <URI>\bastion\officia\maintenance\log_rotation</URI>
  </RegistrationInfo>
  <Triggers>
    <CalendarTrigger><StartBoundary>2026-06-24T10:00:00.000Z</StartBoundary><Enabled>true</Enabled><ScheduleByMonth><DaysOfMonth><Day>1</Day></DaysOfMonth><Months><January /><February /><March /><April /><May /><June /><July /><August /><September /><October /><November /><December /></Months></ScheduleByMonth></CalendarTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>alfonso</UserId>
      <RunLevel>LeastPrivilege</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <WakeToRun>false</WakeToRun>
    <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <IdleSettings><Duration>PT10M</Duration><WaitTimeout>PT1H</WaitTimeout></IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <ExecutionTimeLimit>PT01H</ExecutionTimeLimit>
    <RestartCount>3</RestartCount>
    <RestartInterval>PT1M</RestartInterval>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>c:\windows\system32\forfiles.exe</Command>
      <Arguments>/p c:\logs /s /m *.log /d -30 /c "cmd /c del @path"</Arguments>
      <WorkingDirectory>c:\windows\system32</WorkingDirectory>
    </Exec>
  </Actions>
</Task>
:: t-015 :: idle workstation hibernate \bastion\officia\system\ 
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2026-06-13T01:58:09.078Z</Date>
    <Author>alfonso</Author>
    <Description>reduce power draw when the workstation is unattended.</Description>
    <URI>\bastion\officia\system\idle_workstation_hibernate</URI>
  </RegistrationInfo>
  <Triggers>
    <IdleTrigger><Enabled>true</Enabled></IdleTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>alfonso</UserId>
      <RunLevel>LeastPrivilege</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
    <WakeToRun>false</WakeToRun>
    <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>
    <RunOnlyIfIdle>true</RunOnlyIfIdle>
    <IdleSettings><Duration>PT30M</Duration><WaitTimeout>PT1H</WaitTimeout></IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <ExecutionTimeLimit>PT01H</ExecutionTimeLimit>
    <RestartCount>3</RestartCount>
    <RestartInterval>PT1M</RestartInterval>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>c:\windows\system32\shutdown.exe</Command>
      <Arguments>/h</Arguments>
      <WorkingDirectory>c:\windows\system32</WorkingDirectory>
    </Exec>
  </Actions>
</Task>
:: t-016 :: event 6008 watchdog \bastion\officia\security\ 
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2026-06-13T01:58:09.078Z</Date>
    <Author>system</Author>
    <Description>react to unexpected shutdown events captured in the system log.</Description>
    <URI>\bastion\officia\security\event_6008_watchdog</URI>
  </RegistrationInfo>
  <Triggers>
    <EventTrigger><Enabled>true</Enabled><Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="system"&gt;&lt;Select Path="system"&gt;*[System[(EventID=6008)]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription></EventTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>system</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <WakeToRun>false</WakeToRun>
    <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <IdleSettings><Duration>PT10M</Duration><WaitTimeout>PT1H</WaitTimeout></IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <ExecutionTimeLimit>PT01H</ExecutionTimeLimit>
    <RestartCount>3</RestartCount>
    <RestartInterval>PT1M</RestartInterval>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>c:\windows\system32\powershell.exe</Command>
      <Arguments>-noprofile -file c:\bastion\scripts\notify-incident.ps1</Arguments>
      <WorkingDirectory>c:\windows\system32</WorkingDirectory>
    </Exec>
  </Actions>
</Task>
:: 08 :: machine-readable manifest :: json 
{
  "schema": "bastion-universalis/officia-export@2",
  "target": "windows-task-scheduler",
  "generatedAt": "2026-06-13T01:58:09.073Z",
  "operator": "alfonso",
  "counts": {
    "total": 16,
    "ready": 13,
    "disabled": 2,
    "failed": 1
  },
  "tasks": [
    {
      "description": "keep the workstation aligned with the latest security baseline.",
      "command": "c:\\windows\\system32\\sc.exe start wuauserv",
      "frequency": "daily",
      "author": "system",
      "lastRun": "2026-06-12T09:00:00.000Z",
      "notes": "critical for security posture. do not disable.",
      "createdAt": "2026-05-13T16:00:00.000Z",
      "workingDirectory": "c:\\windows\\system32",
      "daysOfWeek": [],
      "dayOfMonth": null,
      "eventChannel": "",
      "eventId": null,
      "runWithHighestPrivileges": true,
      "hidden": false,
      "wakeToRun": false,
      "onlyIfOnAC": true,
      "startIfNetworkAvailable": true,
      "startOnlyIfIdle": false,
      "idleMinutes": 10,
      "allowOnDemand": true,
      "stopIfRunsLongerThan": "01:00:00",
      "retryOnFailureCount": 3,
      "retryIntervalMinutes": 1,
      "lastResult": "0x0",
      "taskPath": "\\bastion\\officia\\updates\\",
      "id": "t-001",
      "name": "system update scan",
      "purpose": "keep the workstation aligned with the latest security baseline.",
      "program": "c:\\windows\\system32\\sc.exe",
      "arguments": "start wuauserv",
      "time": "03:00",
      "triggerType": "daily",
      "category": "updates",
      "runAsUser": "system",
      "status": "ready",
      "nextRun": "2026-06-13T09:00:00.000Z"
    },
    {
      "description": "detect malware in high-risk paths every 24h.",
      "command": "c:\\programdata\\microsoft\\windows defender\\platform\\mpcmdrun.exe -scan -scantype 1",
      "frequency": "daily",
      "author": "system",
      "lastRun": "2026-06-12T08:00:00.000Z",
      "notes": "full scan delegated to weekly schedule.",
      "createdAt": "2026-05-13T16:00:00.000Z",
      "workingDirectory": "c:\\windows\\system32",
      "daysOfWeek": [],
      "dayOfMonth": null,
      "eventChannel": "",
      "eventId": null,
      "runWithHighestPrivileges": true,
      "hidden": false,
      "wakeToRun": false,
      "onlyIfOnAC": true,
      "startIfNetworkAvailable": true,
      "startOnlyIfIdle": false,
      "idleMinutes": 10,
      "allowOnDemand": true,
      "stopIfRunsLongerThan": "01:00:00",
      "retryOnFailureCount": 3,
      "retryIntervalMinutes": 1,
      "lastResult": "0x0",
      "taskPath": "\\bastion\\officia\\security\\",
      "id": "t-002",
      "name": "defender quick scan",
      "purpose": "detect malware in high-risk paths every 24h.",
      "program": "c:\\programdata\\microsoft\\windows defender\\platform\\mpcmdrun.exe",
      "arguments": "-scan -scantype 1",
      "time": "02:00",
      "triggerType": "daily",
      "category": "security",
      "runAsUser": "system",
      "status": "ready",
      "nextRun": "2026-06-13T08:00:00.000Z"
    },
    {
      "description": "protect critical files against accidental loss.",
      "command": "c:\\windows\\system32\\robocopy.exe c:\\users\\alfonso\\documents d:\\backups\\documents /mir /xo /r:3 /w:5",
      "frequency": "daily",
      "author": "alfonso",
      "lastRun": "2026-06-12T05:00:00.000Z",
      "notes": "audit free space on d: monthly.",
      "createdAt": "2026-05-13T16:00:00.000Z",
      "workingDirectory": "c:\\windows\\system32",
      "daysOfWeek": [],
      "dayOfMonth": null,
      "eventChannel": "",
      "eventId": null,
      "runWithHighestPrivileges": false,
      "hidden": false,
      "wakeToRun": true,
      "onlyIfOnAC": false,
      "startIfNetworkAvailable": true,
      "startOnlyIfIdle": false,
      "idleMinutes": 10,
      "allowOnDemand": true,
      "stopIfRunsLongerThan": "01:00:00",
      "retryOnFailureCount": 3,
      "retryIntervalMinutes": 1,
      "lastResult": "0x0",
      "taskPath": "\\bastion\\officia\\backup\\",
      "id": "t-003",
      "name": "documents mirror",
      "purpose": "protect critical files against accidental loss.",
      "program": "c:\\windows\\system32\\robocopy.exe",
      "arguments": "c:\\users\\alfonso\\documents d:\\backups\\documents /mir /xo /r:3 /w:5",
      "time": "23:00",
      "triggerType": "daily",
      "category": "backup",
      "runAsUser": "alfonso",
      "status": "ready",
      "nextRun": "2026-06-13T05:00:00.000Z"
    },
    {
      "description": "reclaim disk space and improve runtime performance.",
      "command": "c:\\windows\\system32\\cleanmgr.exe /sagerun:1",
      "frequency": "weekly",
      "author": "alfonso",
      "lastRun": "2026-06-08T10:30:00.000Z",
      "notes": "clears temp, recycle bin and browser caches.",
      "createdAt": "2026-05-13T16:00:00.000Z",
      "workingDirectory": "c:\\windows\\system32",
      "daysOfWeek": [
        "sun"
      ],
      "dayOfMonth": null,
      "eventChannel": "",
      "eventId": null,
      "runWithHighestPrivileges": true,
      "hidden": false,
      "wakeToRun": false,
      "onlyIfOnAC": true,
      "startIfNetworkAvailable": true,
      "startOnlyIfIdle": false,
      "idleMinutes": 10,
      "allowOnDemand": true,
      "stopIfRunsLongerThan": "01:00:00",
      "retryOnFailureCount": 3,
      "retryIntervalMinutes": 1,
      "lastResult": "0x0",
      "taskPath": "\\bastion\\officia\\maintenance\\",
      "id": "t-004",
      "name": "disk cleanup",
      "purpose": "reclaim disk space and improve runtime performance.",
      "program": "c:\\windows\\system32\\cleanmgr.exe",
      "arguments": "/sagerun:1",
      "time": "04:30",
      "triggerType": "weekly",
      "category": "maintenance",
      "runAsUser": "alfonso",
      "status": "ready",
      "nextRun": "2026-06-15T10:30:00.000Z"
    },
    {
      "description": "run trim against the ssd to maintain peak throughput.",
      "command": "c:\\windows\\system32\\defrag.exe c: /o",
      "frequency": "weekly",
      "author": "system",
      "lastRun": "2026-06-07T11:00:00.000Z",
      "notes": "trim only, no legacy defrag on ssd.",
      "createdAt": "2026-05-13T16:00:00.000Z",
      "workingDirectory": "c:\\windows\\system32",
      "daysOfWeek": [
        "sat"
      ],
      "dayOfMonth": null,
      "eventChannel": "",
      "eventId": null,
      "runWithHighestPrivileges": true,
      "hidden": false,
      "wakeToRun": false,
      "onlyIfOnAC": true,
      "startIfNetworkAvailable": true,
      "startOnlyIfIdle": false,
      "idleMinutes": 10,
      "allowOnDemand": true,
      "stopIfRunsLongerThan": "01:00:00",
      "retryOnFailureCount": 3,
      "retryIntervalMinutes": 1,
      "lastResult": "0x0",
      "taskPath": "\\bastion\\officia\\maintenance\\",
      "id": "t-005",
      "name": "ssd trim optimize",
      "purpose": "run trim against the ssd to maintain peak throughput.",
      "program": "c:\\windows\\system32\\defrag.exe",
      "arguments": "c: /o",
      "time": "05:00",
      "triggerType": "weekly",
      "category": "maintenance",
      "runAsUser": "system",
      "status": "ready",
      "nextRun": "2026-06-14T11:00:00.000Z"
    },
    {
      "description": "ensure files are mirrored offsite as soon as session begins.",
      "command": "c:\\program files\\cloudvault\\cloudvault.exe /background",
      "frequency": "on logon",
      "author": "alfonso",
      "lastRun": "2026-06-12T14:00:00.000Z",
      "notes": "runs automatically at session start.",
      "createdAt": "2026-05-13T16:00:00.000Z",
      "workingDirectory": "c:\\windows\\system32",
      "daysOfWeek": [],
      "dayOfMonth": null,
      "eventChannel": "",
      "eventId": null,
      "runWithHighestPrivileges": false,
      "hidden": false,
      "wakeToRun": false,
      "onlyIfOnAC": true,
      "startIfNetworkAvailable": true,
      "startOnlyIfIdle": false,
      "idleMinutes": 10,
      "allowOnDemand": true,
      "stopIfRunsLongerThan": "01:00:00",
      "retryOnFailureCount": 3,
      "retryIntervalMinutes": 1,
      "lastResult": "0x0",
      "taskPath": "\\bastion\\officia\\backup\\",
      "id": "t-006",
      "name": "cloud vault sync",
      "purpose": "ensure files are mirrored offsite as soon as session begins.",
      "program": "c:\\program files\\cloudvault\\cloudvault.exe",
      "arguments": "/background",
      "time": "08:00",
      "triggerType": "on logon",
      "category": "backup",
      "runAsUser": "alfonso",
      "status": "ready",
      "nextRun": "2026-06-13T14:00:00.000Z"
    },
    {
      "description": "proactively detect connectivity degradation.",
      "command": "c:\\windows\\system32\\cmd.exe /c ping -n 4 8.8.8.8 >> c:\\logs\\net.log && ping -n 4 1.1.1.1 >> c:\\logs\\net.log",
      "frequency": "daily",
      "author": "alfonso",
      "lastRun": "2026-06-12T13:00:00.000Z",
      "notes": "output logged to c:\\logs\\net.log",
      "createdAt": "2026-05-13T16:00:00.000Z",
      "workingDirectory": "c:\\windows\\system32",
      "daysOfWeek": [],
      "dayOfMonth": null,
      "eventChannel": "",
      "eventId": null,
      "runWithHighestPrivileges": false,
      "hidden": false,
      "wakeToRun": false,
      "onlyIfOnAC": true,
      "startIfNetworkAvailable": true,
      "startOnlyIfIdle": false,
      "idleMinutes": 10,
      "allowOnDemand": true,
      "stopIfRunsLongerThan": "01:00:00",
      "retryOnFailureCount": 3,
      "retryIntervalMinutes": 1,
      "lastResult": "0x0",
      "taskPath": "\\bastion\\officia\\network\\",
      "id": "t-007",
      "name": "network probe",
      "purpose": "proactively detect connectivity degradation.",
      "program": "c:\\windows\\system32\\cmd.exe",
      "arguments": "/c ping -n 4 8.8.8.8 >> c:\\logs\\net.log && ping -n 4 1.1.1.1 >> c:\\logs\\net.log",
      "time": "07:00",
      "triggerType": "daily",
      "category": "network",
      "runAsUser": "alfonso",
      "status": "running",
      "nextRun": "2026-06-13T13:00:00.000Z"
    },
    {
      "description": "avoid stale name resolution issues across sessions.",
      "command": "c:\\windows\\system32\\ipconfig.exe /flushdns",
      "frequency": "weekly",
      "author": "alfonso",
      "lastRun": "2026-06-05T12:00:00.000Z",
      "notes": "paused while validating new router profile.",
      "createdAt": "2026-05-13T16:00:00.000Z",
      "workingDirectory": "c:\\windows\\system32",
      "daysOfWeek": [
        "mon"
      ],
      "dayOfMonth": null,
      "eventChannel": "",
      "eventId": null,
      "runWithHighestPrivileges": true,
      "hidden": false,
      "wakeToRun": false,
      "onlyIfOnAC": true,
      "startIfNetworkAvailable": true,
      "startOnlyIfIdle": false,
      "idleMinutes": 10,
      "allowOnDemand": true,
      "stopIfRunsLongerThan": "01:00:00",
      "retryOnFailureCount": 3,
      "retryIntervalMinutes": 1,
      "lastResult": "0x0",
      "taskPath": "\\bastion\\officia\\network\\",
      "id": "t-008",
      "name": "dns cache flush",
      "purpose": "avoid stale name resolution issues across sessions.",
      "program": "c:\\windows\\system32\\ipconfig.exe",
      "arguments": "/flushdns",
      "time": "06:00",
      "triggerType": "weekly",
      "category": "network",
      "runAsUser": "alfonso",
      "status": "disabled",
      "nextRun": "2026-06-17T12:00:00.000Z"
    },
    {
      "description": "hunt persistent threats and dormant payloads.",
      "command": "c:\\programdata\\microsoft\\windows defender\\platform\\mpcmdrun.exe -scan -scantype 2",
      "frequency": "weekly",
      "author": "system",
      "lastRun": "2026-06-09T07:00:00.000Z",
      "notes": "runs sunday before dawn. duration 2-3h.",
      "createdAt": "2026-05-13T16:00:00.000Z",
      "workingDirectory": "c:\\windows\\system32",
      "daysOfWeek": [
        "sun"
      ],
      "dayOfMonth": null,
      "eventChannel": "",
      "eventId": null,
      "runWithHighestPrivileges": true,
      "hidden": false,
      "wakeToRun": false,
      "onlyIfOnAC": true,
      "startIfNetworkAvailable": true,
      "startOnlyIfIdle": false,
      "idleMinutes": 10,
      "allowOnDemand": true,
      "stopIfRunsLongerThan": "04:00:00",
      "retryOnFailureCount": 3,
      "retryIntervalMinutes": 1,
      "lastResult": "0x0",
      "taskPath": "\\bastion\\officia\\security\\",
      "id": "t-009",
      "name": "defender full scan",
      "purpose": "hunt persistent threats and dormant payloads.",
      "program": "c:\\programdata\\microsoft\\windows defender\\platform\\mpcmdrun.exe",
      "arguments": "-scan -scantype 2",
      "time": "01:00",
      "triggerType": "weekly",
      "category": "security",
      "runAsUser": "system",
      "status": "ready",
      "nextRun": "2026-06-16T07:00:00.000Z"
    },
    {
      "description": "avoid late payment charges on revolving credit account.",
      "command": "c:\\windows\\system32\\msg.exe %username% \"credit account due today\"",
      "frequency": "monthly",
      "author": "alfonso",
      "lastRun": "2026-05-20T15:00:00.000Z",
      "notes": "configured for day 15 of every month.",
      "createdAt": "2026-05-13T16:00:00.000Z",
      "workingDirectory": "c:\\windows\\system32",
      "daysOfWeek": [],
      "dayOfMonth": 15,
      "eventChannel": "",
      "eventId": null,
      "runWithHighestPrivileges": false,
      "hidden": false,
      "wakeToRun": false,
      "onlyIfOnAC": true,
      "startIfNetworkAvailable": true,
      "startOnlyIfIdle": false,
      "idleMinutes": 10,
      "allowOnDemand": true,
      "stopIfRunsLongerThan": "01:00:00",
      "retryOnFailureCount": 3,
      "retryIntervalMinutes": 1,
      "lastResult": "0x0",
      "taskPath": "\\bastion\\officia\\personal\\",
      "id": "t-010",
      "name": "credit due notice",
      "purpose": "avoid late payment charges on revolving credit account.",
      "program": "c:\\windows\\system32\\msg.exe",
      "arguments": "%username% \"credit account due today\"",
      "time": "09:00",
      "triggerType": "monthly",
      "category": "personal",
      "runAsUser": "alfonso",
      "status": "ready",
      "nextRun": "2026-06-19T15:00:00.000Z"
    },
    {
      "description": "mitigate intermittent input freezes on resume.",
      "command": "c:\\windows\\system32\\cmd.exe /c net stop syntpenhservice && net start syntpenhservice",
      "frequency": "on boot",
      "author": "system",
      "lastRun": "2026-06-12T18:00:00.000Z",
      "notes": "temporary workaround pending driver update.",
      "createdAt": "2026-05-13T16:00:00.000Z",
      "workingDirectory": "c:\\windows\\system32",
      "daysOfWeek": [],
      "dayOfMonth": null,
      "eventChannel": "",
      "eventId": null,
      "runWithHighestPrivileges": true,
      "hidden": false,
      "wakeToRun": false,
      "onlyIfOnAC": true,
      "startIfNetworkAvailable": true,
      "startOnlyIfIdle": false,
      "idleMinutes": 10,
      "allowOnDemand": true,
      "stopIfRunsLongerThan": "01:00:00",
      "retryOnFailureCount": 3,
      "retryIntervalMinutes": 1,
      "lastResult": "0x0",
      "taskPath": "\\bastion\\officia\\system\\",
      "id": "t-011",
      "name": "pointer driver reset",
      "purpose": "mitigate intermittent input freezes on resume.",
      "program": "c:\\windows\\system32\\cmd.exe",
      "arguments": "/c net stop syntpenhservice && net start syntpenhservice",
      "time": "00:00",
      "triggerType": "on boot",
      "category": "system",
      "runAsUser": "system",
      "status": "ready",
      "nextRun": "2026-06-13T18:00:00.000Z"
    },
    {
      "description": "maintain auditable record of critical system events.",
      "command": "c:\\windows\\system32\\wevtutil.exe epl security c:\\logs\\security_%date%.evtx",
      "frequency": "weekly",
      "author": "system",
      "lastRun": "2026-06-12T05:30:00.000Z",
      "notes": "retain logs for 90 days minimum.",
      "createdAt": "2026-05-13T16:00:00.000Z",
      "workingDirectory": "c:\\windows\\system32",
      "daysOfWeek": [
        "fri"
      ],
      "dayOfMonth": null,
      "eventChannel": "",
      "eventId": null,
      "runWithHighestPrivileges": true,
      "hidden": false,
      "wakeToRun": false,
      "onlyIfOnAC": true,
      "startIfNetworkAvailable": true,
      "startOnlyIfIdle": false,
      "idleMinutes": 10,
      "allowOnDemand": true,
      "stopIfRunsLongerThan": "01:00:00",
      "retryOnFailureCount": 3,
      "retryIntervalMinutes": 1,
      "lastResult": "0x0",
      "taskPath": "\\bastion\\officia\\security\\",
      "id": "t-012",
      "name": "security event export",
      "purpose": "maintain auditable record of critical system events.",
      "program": "c:\\windows\\system32\\wevtutil.exe",
      "arguments": "epl security c:\\logs\\security_%date%.evtx",
      "time": "23:30",
      "triggerType": "weekly",
      "category": "security",
      "runAsUser": "system",
      "status": "ready",
      "nextRun": "2026-06-19T05:30:00.000Z"
    },
    {
      "description": "maintain hardware controller stability over time.",
      "command": "c:\\windows\\system32\\pnputil.exe /scan-devices",
      "frequency": "monthly",
      "author": "alfonso",
      "lastRun": "2026-05-23T16:00:00.000Z",
      "notes": "last run failed :: check elevated permissions.",
      "createdAt": "2026-05-13T16:00:00.000Z",
      "workingDirectory": "c:\\windows\\system32",
      "daysOfWeek": [],
      "dayOfMonth": 1,
      "eventChannel": "",
      "eventId": null,
      "runWithHighestPrivileges": true,
      "hidden": false,
      "wakeToRun": false,
      "onlyIfOnAC": true,
      "startIfNetworkAvailable": true,
      "startOnlyIfIdle": false,
      "idleMinutes": 10,
      "allowOnDemand": true,
      "stopIfRunsLongerThan": "01:00:00",
      "retryOnFailureCount": 3,
      "retryIntervalMinutes": 1,
      "lastResult": "0x800704c7",
      "taskPath": "\\bastion\\officia\\updates\\",
      "id": "t-013",
      "name": "chipset driver scan",
      "purpose": "maintain hardware controller stability over time.",
      "program": "c:\\windows\\system32\\pnputil.exe",
      "arguments": "/scan-devices",
      "time": "10:00",
      "triggerType": "monthly",
      "category": "updates",
      "runAsUser": "alfonso",
      "status": "failed",
      "nextRun": "2026-06-22T16:00:00.000Z"
    },
    {
      "description": "prevent log directory bloat across volumes.",
      "command": "c:\\windows\\system32\\forfiles.exe /p c:\\logs /s /m *.log /d -30 /c \"cmd /c del @path\"",
      "frequency": "monthly",
      "author": "alfonso",
      "lastRun": "2026-05-25T10:00:00.000Z",
      "notes": "retain only recent operational logs.",
      "createdAt": "2026-05-13T16:00:00.000Z",
      "workingDirectory": "c:\\windows\\system32",
      "daysOfWeek": [],
      "dayOfMonth": 1,
      "eventChannel": "",
      "eventId": null,
      "runWithHighestPrivileges": false,
      "hidden": false,
      "wakeToRun": false,
      "onlyIfOnAC": true,
      "startIfNetworkAvailable": true,
      "startOnlyIfIdle": false,
      "idleMinutes": 10,
      "allowOnDemand": true,
      "stopIfRunsLongerThan": "01:00:00",
      "retryOnFailureCount": 3,
      "retryIntervalMinutes": 1,
      "lastResult": "0x0",
      "taskPath": "\\bastion\\officia\\maintenance\\",
      "id": "t-014",
      "name": "log rotation",
      "purpose": "prevent log directory bloat across volumes.",
      "program": "c:\\windows\\system32\\forfiles.exe",
      "arguments": "/p c:\\logs /s /m *.log /d -30 /c \"cmd /c del @path\"",
      "time": "04:00",
      "triggerType": "monthly",
      "category": "maintenance",
      "runAsUser": "alfonso",
      "status": "ready",
      "nextRun": "2026-06-24T10:00:00.000Z"
    },
    {
      "description": "reduce power draw when the workstation is unattended.",
      "command": "c:\\windows\\system32\\shutdown.exe /h",
      "frequency": "on idle",
      "author": "alfonso",
      "lastRun": "2026-06-12T05:00:00.000Z",
      "notes": "fires after 30 min of inactivity.",
      "createdAt": "2026-05-13T16:00:00.000Z",
      "workingDirectory": "c:\\windows\\system32",
      "daysOfWeek": [],
      "dayOfMonth": null,
      "eventChannel": "",
      "eventId": null,
      "runWithHighestPrivileges": false,
      "hidden": false,
      "wakeToRun": false,
      "onlyIfOnAC": false,
      "startIfNetworkAvailable": true,
      "startOnlyIfIdle": true,
      "idleMinutes": 30,
      "allowOnDemand": true,
      "stopIfRunsLongerThan": "01:00:00",
      "retryOnFailureCount": 3,
      "retryIntervalMinutes": 1,
      "lastResult": "0x0",
      "taskPath": "\\bastion\\officia\\system\\",
      "id": "t-015",
      "name": "idle workstation hibernate",
      "purpose": "reduce power draw when the workstation is unattended.",
      "program": "c:\\windows\\system32\\shutdown.exe",
      "arguments": "/h",
      "time": "00:00",
      "triggerType": "on idle",
      "category": "system",
      "runAsUser": "alfonso",
      "status": "queued",
      "nextRun": "2026-06-13T05:30:00.000Z"
    },
    {
      "description": "react to unexpected shutdown events captured in the system log.",
      "command": "c:\\windows\\system32\\powershell.exe -noprofile -file c:\\bastion\\scripts\\notify-incident.ps1",
      "frequency": "on event",
      "author": "system",
      "lastRun": "2026-06-03T10:12:00.000Z",
      "notes": "fires whenever event id 6008 is written to the system channel.",
      "createdAt": "2026-05-13T16:00:00.000Z",
      "workingDirectory": "c:\\windows\\system32",
      "daysOfWeek": [],
      "dayOfMonth": null,
      "eventChannel": "system",
      "eventId": 6008,
      "runWithHighestPrivileges": true,
      "hidden": false,
      "wakeToRun": false,
      "onlyIfOnAC": true,
      "startIfNetworkAvailable": true,
      "startOnlyIfIdle": false,
      "idleMinutes": 10,
      "allowOnDemand": true,
      "stopIfRunsLongerThan": "01:00:00",
      "retryOnFailureCount": 3,
      "retryIntervalMinutes": 1,
      "lastResult": "0x0",
      "taskPath": "\\bastion\\officia\\security\\",
      "id": "t-016",
      "name": "event 6008 watchdog",
      "purpose": "react to unexpected shutdown events captured in the system log.",
      "program": "c:\\windows\\system32\\powershell.exe",
      "arguments": "-noprofile -file c:\\bastion\\scripts\\notify-incident.ps1",
      "time": "00:00",
      "triggerType": "on event",
      "category": "security",
      "runAsUser": "system",
      "status": "ready",
      "nextRun": "2026-06-14T06:00:00.000Z"
    }
  ]
}