Detecting any action related to scheduled tasks from kernel mode. - is it possible?

Take for example this code:
https://msdn.microsoft.com/en-us/library/windows/desktop/aa382113(v=vs.85).aspx
after a few normal API calls, every COM operation is done trough the object’s member functions.
I have looked around but nothing is documented on lower levels.
It seems that everything here is done strictly in user-mode?

None if this is exposed to a KM driver

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Thursday, January 22, 2015 8:13 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Detecting any action related to scheduled tasks from kernel mode. - is it possible?

Take for example this code:
https://msdn.microsoft.com/en-us/library/windows/desktop/aa382113(v=vs.85).aspx
after a few normal API calls, every COM operation is done trough the object’s member functions.
I have looked around but nothing is documented on lower levels.
It seems that everything here is done strictly in user-mode?


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer