Windows Security Log Events by ID

This event actually gets logged for both scheduled task creations as well as changes to exisiting tasks. This event does not get logged when a task is deleted.

If you enable Object Auditing for successes, you will also see file level access events corresponding the *.job file in %SystemRoot%\Tasks\ including delete events. See events 560, 564, 567 and 562.

File name identifies the *.job file where the task definition is stored. Command documents the operating system command that will be executed when the task starts. Triggers specifies how often or what event will trigger the task to start. Time specifies the next time the task will run. Target User is the account the task will run under. By User and Domain identify the user who created or modified the task. Logon ID enables you to connect this event back with the user's initial logon. See event 528 and 540.