Service Control Manager events in EventLog on windows 10 1709

Question

Service Control Manager events in EventLog on windows 10 1709

Anonymous

Hi,

I noticed not all start/stop/restart events for services are logged in the eventviewer system log.

On Windows 7, every start/stop/restart action was logged by the Service Control Manager sources was logged in the System Eventlog.

On windows 10 v1709, this isn't the case anymore.

Is this by design?

Is this a big?

Can I work arround this so we still see all events?

The audit policy is the same on both systems...

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

2 answers

Answer 1

Hi Sumit,

Thanks for your assistance, but this is completely not related.

In previous windows versions, when a services stops, or gets restarted, service.exe would make sure this event was logged in eventviewer. This under the system log, with the source Service Control Manager.

If I now stop or start a service, via services.msc, or via powershell, this isn't logged anymore in the eventlog.

I search for quite some time already, also on the technet forum, but found nothing.

I would like to know the reason why this behaviour is presented on windows 10 1709, and if I can work around this. (meaning, forcing it to log anyway)

If I check the auditpol on both a win 7 and win10, it is the same, so this can't be the cause...

Answer 2

Hi,

I am Sumit, an Independent advisor and a Microsoft MVP here to help.

Regarding your issue, this might be related:

www.winhelponline.com/blog/stop-auto-reopen-programs-restart-windows-10/

Although I can neither confirm nor deny, but you would get better help on Technet forums.

https://social.technet.microsoft.com/Forums/en-...

Please let us know if you need any assistance.

Share via

Service Control Manager events in EventLog on windows 10 1709

2 answers