Are changes to a Windows service logged?
Some yes, some no.
Starts and stops
On all tested server versions of Windows that I've tested, but not on tested client versions, when a service starts or stops, an event gets logged to the
System event log. The source will be "Service Control Manager" and the Event ID will be 7036.
Changes to startup type
On all tested versions of Windows, changing the Startup Type of a service (typically
Automatic (Delayed Start),
Disabled) will result in an event being logged to the
System event log. The source will be "Service Control Manager" and the Event ID will be 7040.
Changes to recovery options
On all tested versions of Windows, changing the Recovery Options of a service does not result in an event being logged. It is possible that an individual service might be configured to log such events to its own section under the
Applications and Services Logs section of Event Viewer, but I have yet to find one that does that.
- Client versions
- Server versions
- Windows Server 2012 R2
- Windows Server 2016
- Windows Server 2019