1

Are changes to a Windows service logged? Specifically, I suspect that the Recovery options were changed for a service and I'm trying to see if that was indeed the situation.

I've tweaked various values and don't see anything in the various Windows event logs. Are service changes logged somewhere?

2

Are changes to a Windows service logged?

Some yes, some no.

Starts and stops

On all tested server versions of Windows that I've tested, but not on tested client versions, when a service starts or stops, an event gets logged to the System event log. The source will be "Service Control Manager" and the Event ID will be 7036.

Changes to startup type

On all tested versions of Windows, changing the Startup Type of a service (typically Automatic, Automatic (Delayed Start), Manual, or Disabled) will result in an event being logged to the System event log. The source will be "Service Control Manager" and the Event ID will be 7040.

Changes to recovery options

On all tested versions of Windows, changing the Recovery Options of a service does not result in an event being logged. It is possible that an individual service might be configured to log such events to its own section under the Applications and Services Logs section of Event Viewer, but I have yet to find one that does that.


Tested versions:

  • Client versions
    • Windows 10
  • Server versions
    • Windows Server 2012 R2
    • Windows Server 2016
    • Windows Server 2019
1
  • Thanks! That was what I found as well but I wondered: Maybe because I'm working with a corporate VM, maybe things are "whacky" : )
    – John Dyer
    Jan 31 '20 at 14:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.