Examkin

Soru

Zorluk: Çok zorWindows Administrative and System Management Tools

A systems administrator needs to configure an automated system recovery workflow on a Windows 11 Pro workstation. Whenever a critical system service unexpectedly terminates and generates Event ID 7031 in the System event log, a custom remediation script must automatically execute with elevated administrative privileges. Place the steps in the correct chronological order to complete this configuration using Windows administrative tools.

  1. 1Launch Event Viewer (eventvwr.msc), navigate to Windows Logs > System, and select the log entry for Event ID 7031.
  2. 2Right-click the selected Event ID 7031 entry and select 'Attach Task To This Event...' to launch the Create Basic Task Wizard.
  3. 3Verify the automatically populated event trigger details (Log: System, Event ID: 7031) on the event trigger configuration page.
  4. 4Select 'Start a program' on the Action tab, then specify the file path and administrative arguments for the automated recovery script.
  5. 5Select the option to open the task's Properties dialog upon completion, then check 'Run with highest privileges' and assign appropriate credentials.

Cevap

The correct operational sequence begins by selecting the target event in Event Viewer, invoking 'Attach Task To This Event...', confirming the pre-filled event trigger parameters, specifying 'Start a program' with the script path, and finally enabling 'Run with highest privileges' in the task properties.
To automate recovery upon a specific Windows event, the administrator must first isolate the event in Event Viewer to use the 'Attach Task To This Event...' shortcut. This transfers the event filter attributes directly to Task Scheduler. After confirming the trigger criteria and setting the action to run the recovery script, the administrator must access the task's full properties to enable 'Run with highest privileges.' Without elevation, the automated script would fail due to insufficient User Account Control (UAC) permissions when attempting to restart system services.

Adım Adım Çözüm

1
Locate the target log entry in Event Viewer
Event metadata for Event ID 7031 is selected in the System log view.
Event Viewer requires highlighting an existing log entry to pass its log source and event ID into the task wizard.
2
Invoke the context menu action 'Attach Task To This Event...'
The Create Basic Task Wizard opens with event parameters pre-configured.
This shortcut links Event Viewer directly to Task Scheduler, streamlining event-triggered task creation.
3
Confirm trigger parameters
Event log, source, and Event ID settings are validated.
Verifying pre-populated data ensures the task fires only when Event ID 7031 is generated.
4
Configure the task action
'Start a program' is selected and pointed to the script location.
Task Scheduler requires an explicit action definition (program/script execution) to carry out remediation.
5
Set execution privileges in Task Scheduler properties
'Run with highest privileges' is selected under administrative credentials.
Standard user context cannot restart Windows services; elevated privileges are necessary for system service management.

Anahtar Kavram

Event-Triggered Administrative Tasks and Privilege Elevation
Bu soruyu puanla

Konular

Windows Administrative and System Management Tools

Bu konudan daha fazla soru