Install and Open ParseScheduledTasksXML¶

Use an isolated, authorised Windows VM. Record the retrieval URL, date, filename, SHA-256 and the exact script version or commit before execution.

Retrieve the script¶

Download ParseScheduledTasksXML.ps1 from the maintainer's GitHub source. Review the script before use and retain the downloaded bytes with the case/tool record.

Record code provenance

The repository may change without a packaged release number. Retain the commit identifier or retrieval date, script hash and source URL so another analyst can identify the code used.

Stage the tool¶

Create C:\Tools\ParseScheduledTasksXML, move the verified script into that directory and avoid mixing case evidence with tool files.

$Screenshot: Move the script to C:\Tools\ParseScheduledTasksXML$

Record its hash from an administrator PowerShell prompt:

Get-FileHash "C:\Tools\ParseScheduledTasksXML\ParseScheduledTasksXML.ps1" -Algorithm SHA256

Open a scoped PowerShell session¶

Check the effective execution policy before changing anything:

Get-ExecutionPolicy -List

If organisational procedure permits a temporary bypass, scope it to the child PowerShell process rather than changing the machine policy:

powershell.exe -NoProfile -ExecutionPolicy Bypass

Execution-policy bypass is not verification

A bypass only permits the script to run in that process. It does not make downloaded code trusted. Review and hash the script first, follow local policy, and do not weaken system-wide settings for this guide.

Verify the help and parameters without parsing evidence:

Get-Help .\ParseScheduledTasksXML.ps1 -Full

Confirm that mandatory -Path and optional -Output are present. The output directory must already exist.