1

I can see plany of services, including one I'm troubleshooting (custom product service) being restarted on a server occasionally. There is no pattern. One service at random is being restarted every 10-15 minutes. My service should not restart by itself at all, yet sometimes is affected by something happenning at the server.

Is there a way to check what or who keeps restarting windows services?

2
  • check the logs should probably be your first step.
    – tony roth
    Apr 11, 2013 at 13:59
  • I know my service is getting restarted after reading logs
    – Random
    Apr 12, 2013 at 11:17

2 Answers 2

2

First off, if your "restricted environment" doesn't allow you to make any changes, then you will most likely not be able to determine the root cause (at least not easily).

If you can make changes to audit settings, then this article should be exactly what you are looking for:

http://windowsitpro.com/systems-management/access-denied-auditing-users-who-might-be-starting-and-stopping-services

Basically, you will enable auditing on your service for successful "start" and "stop" events - or others if you like. These will then be logged to the security event log.

I was going to suggest installing EventSentry Light to then get a real-time alert when that happens, but your restricted environment probably won't allow for that. Hopefully you have a different monitoring solution in place which can do that. Disclaimer: I work for NETIKUS.NET.

1

Install Process Explorer

Once it's up and running:

  1. In the taskbar menu select View and check:

  2. Show Process Tree and the Show Lower Pane options.

  3. Next right click on any column and Select Columns

  4. Now click on the Process Performance tab and check the Start Time box.

You should be able to see the user column be default and now the start time column should be visible.

1
  • Not possible - restricted environment
    – Random
    Apr 12, 2013 at 11:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .