I have a windows service on windows 2003 sp2 r2 that is being stopped, then started, every minute(ish).
I can see the computer, the service account, and the program being restarted, but I cannot tell WHAT is doing the restart command.

Can I use a tool or program to detect where this restart is coming from?

It's as though some program is issuing net stop & net start commands. The service being flipped on and off has no errors, and there is no information anywhere to state an issue. No patches were applied to the machine, and this machine has been left as is for years to run a specific handful of automatic services.
This Saturday, one of the services just started getting stopped and started over and over.

Event logs show clean start and stop in system. Application show good start and stop.... just over and over again.

  • Look at the sysinternals suite of tools, specifically process explorer (procexp) and process monitor (procmon) to get a much finer-grained view of the processes on your system. – HopelessN00b Oct 8 '14 at 13:30
  • I am using Process Explorer, but I cannot find where it shows me who started the service. Do you know where that is shown or what tool may be of help to identify the program doing the restarts on the service? – Matthew Newman Oct 8 '14 at 14:33
  • Right-click -> Properties -> Image tab -> User: field (near the bottom) – HopelessN00b Oct 8 '14 at 14:40
  • Also, I have blocked the service account issuing the stop from being able to initiate the stop... but still have not found WHAT is doing the stop command issuing. – Matthew Newman Oct 8 '14 at 14:41
  • 1
    The user field shows what users the service is running WITH, but not what started the service itself. Service Account 1 is shown in the event logs for system as having sent a successful start and stop command. The service itself is run with a different service account. I could successfully block the service account 1 from issuing a STOP command, but still cannot see what program is using the service account 1 to issue the command to stop the service. – Matthew Newman Oct 8 '14 at 14:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.