Return code of scheduled task prefixed with 0x8007000 in list view, registered as 0 in the event log

Question

I am currently trying to setup monitoring of windows scheduled tasks in Zabbix. It seemed easy enough to just monitor the Microsoft-Windows-TaskScheduler/Operational event log filtered by 201 events and regexing on the return code, but when I started simulating errors to test the monitoring, nothing happened.

It turns out that all our windows 2012 servers always log "return code 0" in the event log, even though it actually, sort of, displays it correctly in the Task Scheduler list view. When I say "sort of", it's because the "Last Run Result" actually displays 0x80070001 if the exit code of the program run by the scheduled task is 1.

I have spend a lot of time tweaking the settings, like user account, Run only when user is logged on, Run whether user is logged on or not, setting path on the action, Run with highest privileges, Configure for Vista/7/2012, etc. Nothing helped.

Finally I did some testing on my local machine, Windows 7, and a 2008R2 server, both of which just worked as expected.

The specific task I was testing ran a PowerShell script, using -Command so that it properly propagates the exit, but to rule out any PS issues I also tested with a batch file containing "exit 1" and finally with a small C# console program, that just returns whatever you supply on the command line. PS, batch and console program all work fine on 7 and 2008, but they all fail in the same manner on 2012.

I've google this to death, but keep coming up short. Apparently 0x80070005 and other similar error codes are have some meaning, but that's not what happens in my case. In my case it seems that my exit code is bitwise or'ed with 0x80070000.

I should note that in all the cases, even 2012, the program started by the task, actually executes and run to the end, it's just the exit code which is handled weirdly.

Following is the output from the test runs:

From Powershell (my shell writes :( if $LASTEXITCODE > 0 ):

54 :( .\ExitCodeTest.exe 1
55 :( $LASTEXITCODE
1

56 :) .\ExitCodeTest.exe 10
57 :( $LASTEXITCODE
10

Windows Server 2008 R2 Standard:

Last Run Result (from list view): 0xA
Event 201 from event log Microsoft-Windows-TaskScheduler/Operational:
Task Scheduler successfully completed task "\ErrorTest" , 
instance "{b67a26cf-7fd8-461a-93d9-a5e48e72e558}" , 
action "D:\Tasks\ExitCodeTest.exe" with return code 10.

Windows Server 2012 Datacenter (notice that the return code in the event log is 0):

Last Run Result (from list view): 0x8007000A
Event 201 from event log Microsoft-Windows-TaskScheduler/Operational:
Task Scheduler successfully completed task "\error test" , 
instance "{2bde46b8-2858-4772-a7ec-d66b29d893a6}" , 
action "D:\Tasks\ExitCodeTest.exe" with return code 0.

Source for ExitCodeTest.exe:

static void Main( string[] args )
{
    int exitCode = 0;
    if ( args.Length > 0 )
    {
        exitCode = Convert.ToInt32( args[0] );
    }
    Environment.Exit( exitCode );
}

Please help, I am at my wits end.

Thanks, John

Answer 1

(this is NOT an answer, but StackOverflow is refusing to let me add comments - when I click 'add comment', browser scrolls to top of page :-/)

You may be misinterpreting the Last Run Result column. According to Wikipedia (http://en.wikipedia.org/wiki/Windows_Task_Scheduler), LRR values of 0, 1 and 10 are common. Ignore the 0x8007 prefix - this just indicates a WIN32 error code transformed into an HRESULT (http://msdn.microsoft.com/en-us/library/gg567305.aspx).

Try running the test and forcing an exit code of something other than 1 or 10 to see if this influences LRR.

This does not explain of course why action return code is 0 in 2012. Error code 10 is defined as 'environment is incorrect'. Could it be that 2012 server does not want to run 32bit executable?

One other suggestion (and I'm a little out of my depth); according to (http://msdn.microsoft.com/en-us/library/system.environment.exit(v=vs.110).aspx): "Exit requires the caller to have permission to call unmanaged code. The return statement does not.". Might be worth re-compiling ExitCodeTest as follows:

static int Main(string[] args)
    {    
        int exitCode = 0;
        if ( args.Length > 0 )
        {
            exitCode = Convert.ToInt32( args[0] );
        }
        return exitCode;
    }

Answer 2

I'm seeing a similar issue on Server 2012 with a batch file that looks like it succeeds, shows a return value of 0 in event log, but a Last Run Result of 0x80070001.

I see MSFT has a hotfix available for Server 2012 which might address this issue:

http://support.microsoft.com/kb/3003689