https://www.bleepingcomputer.com/news/security/why-everyone-should-disable-vssadmin-exe-now/ The WMIC command that can be used is: Wmic.exe /Namespace:\\root\default Path SystemRestore Call CreateRestorePoint "%DATE%", 100, 7 When creating the new scheduled task, create it as a New Task. Then in the General tab make sure you have it set to Run whether user is logged on or not and to Run with highest privileges as shown in the image below. These settings will prompt you to store your password so that it can run when you are not logged on. For those who want to use this task via GPO and can't push out the password to store, you can set it to Run only when user is logged on instead. Finally, in the Actions tab, click on the New button and then enter C:\Windows\System32\wbem\WMIC.exe into the Program/Script field. In the Add arguments field you want to enter /Namespace:\\root\default Path SystemRestore Call CreateRestorePoint "%DATE%", 100, 7. When it is done it should look like the image below. How to rename vssadmin Unfortunately, as this file is owned by the special Windows account called TrustedInstaller, it is not a simple task to rename. In order to rename vssadmin.exe you first have take ownership of the file, give yourself the permissions to modify it, and then rename it. In order to make this task easier, I have put together a small batch file that does this for you. Renvbs.bat, which is shown below, will change the ownership of the vssadmin.exe file from TrustedInstaller to the Administrators group. It will then give the Administrators the Change permission so that they can rename it. Finally the batch file will rename the file in the format vssadmin.exe-date-time. Feel free to modify the name of the renamed file in the batch file for extra security. @echo off REM We are redirecting the output of the commands and any errors to NUL. REM If you would like to see the output, then remove the 2>NUL from the end of the commands. REM Check if vssadmin.exe exists. If not, abort the script if NOT exist %WinDir%\system32\vssadmin.exe ( echo. echo.%WinDir%\system32\vssadmin.exe does not exist! echo. echo Script Aborting! echo. PAUSE goto:eof ) REM Check if the script was started with Administrator privileges. REM Method from http://stackoverflow.com/questions/4051883/batch-script-how-to-check-for-admin-rights net session >nul 2>&1 if %errorLevel% NEQ 0 ( echo. echo You do not have the required Administrator privileges. echo. echo Please run the script again as an Administrator. echo. echo Script Aborting! echo. PAUSE goto:eof ) REM We need to give the Administrators ownership before we can change permissions on the file takeown /F %WinDir%\system32\vssadmin.exe /A >nul 2>&1 REM Give Administrators the Change permissions for the file CACLS %WinDir%\system32\vssadmin.exe /E /G "Administrators":C >nul 2>&1 REM Generate the name we are going to use when rename vssadmin.exe REM This filename will be based off of the date and time. REM http://blogs.msdn.com/b/myocom/archive/2005/06/03/so-what-the-heck-just-happened-there.aspx for /f "delims=/ tokens=1-3" %%a in ("%DATE:~4%") do ( for /f "delims=:. tokens=1-4" %%m in ("%TIME: =0%") do ( set RenFile=vssadmin.exe-%%c-%%b-%%a-%%m%%n%%o%%p ) ) REM Rename vssadmin.exe to the filename in the RenFile variable ren %WinDir%\system32\vssadmin.exe %RenFile% >nul 2>&1 REM Check if the task was completed successfully if exist %WinDir%\system32\%RenFile% ( echo. echo vssadmin.exe has been successfully renamed echo to %WinDir%\system32\%RenFile%. pause ) else ( echo. echo There was a problem renaming vssadmin.exe echo to %WinDir%\system32\%RenFile%. echo. pause ) :END