Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I can see plany of services, including one I'm troubleshooting (custom product service) being restarted on a server occasionally. There is no pattern. One service at random is being restarted every 10-15 minutes. My service should not restart by itself at all, yet sometimes is affected by something happenning at the server.

Is there a way to check what or who keeps restarting windows services?

share|improve this question
    
check the logs should probably be your first step. –  tony roth Apr 11 '13 at 13:59
    
I know my service is getting restarted after reading logs –  Random Apr 12 '13 at 11:17

2 Answers 2

up vote 2 down vote accepted

First off, if your "restricted environment" doesn't allow you to make any changes, then you will most likely not be able to determine the root cause (at least not easily).

If you can make changes to audit settings, then this article should be exactly what you are looking for:

http://windowsitpro.com/systems-management/access-denied-auditing-users-who-might-be-starting-and-stopping-services

Basically, you will enable auditing on your service for successful "start" and "stop" events - or others if you like. These will then be logged to the security event log.

I was going to suggest installing EventSentry Light to then get a real-time alert when that happens, but your restricted environment probably won't allow for that. Hopefully you have a different monitoring solution in place which can do that. Disclaimer: I work for NETIKUS.NET.

share|improve this answer

Install Process Explorer

Once it's up and running:

  1. In the taskbar menu select View and check:

  2. Show Process Tree and the Show Lower Pane options.

  3. Next right click on any column and Select Columns

  4. Now click on the Process Performance tab and check the Start Time box.

You should be able to see the user column be default and now the start time column should be visible.

share|improve this answer
    
Not possible - restricted environment –  Random Apr 12 '13 at 11:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.