Windows event id for battery level change

I need to create a task in Task Scheduler based on battery level change

Windows doesn't log this kind of detail as events. You can however use something like the batch file below and create a custom event.

Battery.cmd

This batch file monitors the current battery percentage charge and creates a user defined event if the charge drops below a user defined threshold value.

@echo off
setlocal EnableDelayedExpansion
rem set threshold value
set _threshold=82
:start
rem get the battery charge
rem use findstr to strip blank lines from wmic output
for /f "usebackq skip=1 tokens=1" %%i in (`wmic Path Win32_Battery Get EstimatedChargeRemaining ^| findstr /r /v "^$"`) do (
  set _charge=%%i
  echo !_charge!
  if !_charge! lss !_threshold! (
    echo threshold reached
    rem create a custom event in the application event log
    rem requires administrator privileges 
    eventcreate /l APPLICATION /t WARNING /ID 999 /D "Battery charge has dropped"
    goto :done
    ) else (
    rem wait for 10 minutes then try again
    timeout /t 600 /nobreak
    goto :start
    )
  )
:done
endlocal

Notes:

• The Eventcreate command works on Windows XP up to and including Windows 10, it requires administrator privileges to work
• Set _threshold as required
• If the battery falls below this value an event with ID 999 will be generated in the APPLICATION event log with the description Battery charge has dropped
• Modify the eventcreate command as required for your situation.
• Modify the timeout delay as required for your situation.

Example output:

My battery currently has a charge of 81%. I set the threshold to 82. Here is what happens when I run Battery.cmd:

> battery
81
threshold reached

SUCCESS: An event of type 'WARNING' was created in the 'APPLICATION' log with 'EventCreate' as the source.

And here is the new entry in the Event Log:

eventcreate syntax

EVENTCREATE [/S system [/U username [/P [password]]]] /ID eventid
            [/L logname] [/SO srcname] /T type /D description

Description:
    This command line tool enables an administrator to create
    a custom event ID and message in a specified event log.

Parameter List:
    /S    system           Specifies the remote system to connect to.

    /U    [domain\]user    Specifies the user context under which
                           the command should execute.

    /P    [password]       Specifies the password for the given
                           user context. Prompts for input if omitted.

    /L    logname          Specifies the event log to create
                           an event in.

    /T    type             Specifies the type of event to create.
                           Valid types: SUCCESS, ERROR, WARNING, INFORMATION.

    /SO   source           Specifies the source to use for the
                           event (if not specified, source will default
                           to 'eventcreate'). A valid source can be any
                           string and should represent the application
                           or component that is generating the event.

    /ID   id               Specifies the event ID for the event. A
                           valid custom message ID is in the range
                           of 1 - 1000.

    /D    description      Specifies the description text for the new event.

    /?                     Displays this help message.


Examples:
    EVENTCREATE /T ERROR /ID 1000
        /L APPLICATION /D "My custom error event for the application log"

    EVENTCREATE /T ERROR /ID 999 /L APPLICATION
        /SO WinWord /D "Winword event 999 happened due to low diskspace"

    EVENTCREATE /S system /T ERROR /ID 100
        /L APPLICATION /D "Custom job failed to install"

    EVENTCREATE /S system /U user /P password /ID 1 /T ERROR
        /L APPLICATION /D "User access failed due to invalid user credentials"

Further Reading

• An A-Z Index of the Windows CMD command line - An excellent reference for all things Windows cmd line related.
• eventcreate - Create a Custom Event in the Windows Event Viewer.
• schtasks - Create / edit a Scheduled Job/Task. The job can be created on the local or a remote computer.
• wmic - Windows Management Instrumentation Command.

There is a Microsoft-Windows-Battery ETW provider with BatteryPercentRemaining event with ID 13. You can code a project that uses TraceEvent to create a realtime listener for this Microsoft-Windows-Battery provider. The event has the entries RemainingPercentage to show the status and PercentageChange to see the change:

When you see this event and see the -1 change for PercentageChange, run the program you want.