Share via

what's the audit event ID for windows service startup account changed ?

sakuraime 2,336 Reputation points
2021-02-07T14:48:55.687+00:00

Are there any windows audit /security event to track windows services startup account changed ?

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
13,726 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Carl Fan 6,876 Reputation points
    2021-02-10T10:04:02.047+00:00

    Hi,
    As far as I know, we could check services start and stop messages
    Within the Event Viewer (Control Panel | Administrative Tools | Event Viewer) on the System tab the Service Control Manager logs who started and stop each event.
    You can definitely just query the Event Viewer's "System" log to look for those events for your Service.
    a service starts/stops Event ID 7040 or 7036
    When you find that, the "User" listed in the details below is the user that has made that change.
    Hope this helps and please help to accept as Answer if the response is useful.
    Best Regards,
    Carl

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.