get application names of AT jobs from scheduled tasks

First of all, you're using AT.EXE. This command handles only a subset of scheduled tasks manipulated using Task Scheduler 1.0.

It's good to know: there are Task Scheduler 1.0 and Task Scheduler 2.0 with separate APIs. Another utility for scheduling tasks is Schtasks.EXE. It lists the tasks listed by AT.EXE as well and show additional tasks added via Schtasks.EXE.

For a good overview and references, see http://en.wikipedia.org/wiki/Task_Scheduler[^] (and references from this document), http://en.wikipedia.org/wiki/At_(Windows)[^], http://en.wikipedia.org/wiki/Schtasks[^].

As I found, information on scheduled tasks is stored in the registry here:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SchedulingAgent

However, it does not help much. Under this key, the value TasksFolder shows you the directory where the tasks are stored (on my system, this is %SystemRoot%\Tasks). Each task is stored in a separate *.JOB file in binary format; the strings are apparently represented in UTF-16LE — that's all. I don't think this format is documented. You really need to access this data using Task Scheduler API, version 1.0 or 2.0.

This is the Microsot example for enumerating of scheduling tasks using Task Scheduler API v.1.0: http://msdn.microsoft.com/en-us/library/aa446831(v=VS.85).aspx[^]
For the similar sample with v.2.0, see http://msdn.microsoft.com/en-us/library/aa446831(v=VS.85).aspx[^].

For more information, start here: http://msdn.microsoft.com/en-us/library/aa383614(v=VS.85).aspx[^].

—SA