Your download link is at the very bottom of the page... always.

Processed through Paypal
No account required.

Donate Bitcoin to this wallet:
Donate Ethereum to this wallet:
Donate Litecoin to this wallet:

Buy our over-priced crap to help keep things running.

Join our Facebook groupFollow us on TwitterFollow us on InstagramOur RSS FeedJoin us on TikTokJoin us on LinkedIn

 Home » Freeware Downloads » System Information and Monitoring » Windows Service Auditor v3.0.2.87   
File - Download Windows Service Auditor v3.0.2.87

Always scroll to the bottom of the page for the download link.
We don't believe in fake/misleading download buttons and tricks. The link is always in the same place.

Windows Service Auditor v3.0.2.87

Easily find out who/what started, stopped or updated your Windows Services

This portable utility enables advanced auditing and probes the Windows Event Logs to help you investigate your important services.

It can be very difficult to figure out who (or what) keeps messing with your essential Windows Services.

Microsoft has provided a few administrative tools to help (such as auditpol and the Event Viewer) but they are poorly documented and can be tricky to configure.

So we created Windows Service Auditor ó a free, easy-to-use application that shines a light on your services.

Use Windows Service Auditor to help you answer burning questions, such as:

* Who stopped my Windows Service?
* When was my service started?
* Who deleted my service?
* At what time did my service start?
* Did my service encounter any errors after it was started?
* Have any Windows Services been added or modified?

The intuitive interface makes it super easy to perform your detective work:

How to use Windows Service Auditor

1) Download Windows Service Auditor. Save the executable file on your desktop, or to another well-known location on your computer.

2) Double-click the WindowsServiceAuditor.exe file to launch the program on your desktop. If necessary, confirm the standard User Account Control (UAC) security prompt to proceed:

3) The window that comes up is divided into two parts. The upper pane lists every service installed on your computer while the lower panel shows the events associated with the service selected in the upper pane.

For example, here you can see the Windows Update service selected:

Double-click a row in the lower panel to see the event's details:

4) Unfortunately the majority of the service events will not show the account that performed the operation. That is because Windows does not keep track of user information by default. You must enable advanced security auditing to capture that level of detail.

Windows Service Auditor makes it easy to enable auditing for your service. Simply check Enable Auditing from the Service menu:

You will be prompted if your computer's Local Audit Policy must be updated. Click OK to proceed:

5) With the audit policy in place, Windows will capture detailed audit events whenever anyone tries to start, stop or update your service.

For example, this event tells us that "Mike Jones" stopped the Windows Update service today at 10:51 AM:

Exporting your services

Would you like to keep a record of the Windows Services installed on your machine? If so, select All Services > Export (XML) to have Windows Service Auditor save all your services to an XML file:

The XML will contain an entry for each service, including dependencies, recovery/failure options, triggers and more.

Note that you can select Selected Service > Export (XML) to save a single service instead.

Working with Local & Global Audit Policies

In order to track users who are starting, stopping or updating a Windows Service, several advanced security audit policies must be enabled. These include:

* Other Object Access
* Handle Manipulation
* Security System Extension

Windows Service Auditor will automatically update your computer's local audit policy the first time that you enable auditing for a service. From that point on, the Event Logs will capture detailed records related to your service.

Note: At any time, you can disable advanced auditing in the areas above by simply un-checking Enable Local Audit Policy, available from the Application menu:

Of course, that will disable auditing for all services.
Domain Computers: Update the Global Audit Policy

If your computer is part of a domain, any changes made by Windows Service Auditor will be overwritten the next time the policy is refreshed by the server. You will have to update the Global Audit Policy yourself to enable advanced auditing.

This guide describes how to update the Global Audit Policy. Configure the system to audit success events in the Other Object Access, Handle Manipulation and Security System Extension areas, which can all be found in the Security Settings / Advanced Audit Policy Configuration / Audit Policies / Object Access section.

Changes: (September 23 2021)

New Features

Full support for Windows 11

Click here to visit the author's website.
Continue below to download this file.

Downloads Views Developer Last Update Version Size Type Rank
653 1,216 Core Technologies Consulting, LLC <img src=""border="0"> Oct 12, 2021 - 11:15 1.84MB EXE 5/5, out of 13 Votes.
File Tags
Windows  Service  Auditor  v3.0.2.87  
Whoa! Slow down there, Speedy.
Read this and then continue to the download.

Like seeing no ads? No misleading/fake download buttons?
We like it too! This site has been kept alive for 14 years
because of people just like you who download and donate.
No one is stopping you from downloading without donating
but the site runs on the "Honor System". If your momma
raised you to be honorable, make a donation and download
'til ya turn blue. Make your momma proud!

Thank you! -Randy & Deanna (The Older Geeks)

Monthly operating costs = $725
Donations for July = $0
Donations over our monthly goal
are set aside for future upgrades and
handed-over to Deanna for new shoes.

Processed securely through Paypal.
No PayPal account required.
Your bank statement will read: "Home Computer Repair LLC".
This is our computer store.


Just send a check to our computer store payable to Home Computer Repair LLC.
Our address: Home Computer Repair LLC, 208 E. Water St. Mount Vernon, MO 65712

Recent Super Donors ($50+)
Thanks, William
Thanks, Warren
Thanks, Michael
Thanks, Sherwin

Recent Donors
Thanks, Jeffrey
Thanks, Owen
Thanks, Charles
Thanks, Robert
Thanks, Craig
Thanks, Raymond
Thanks, Phillip
Thanks, Stan
Thanks, John
Thanks, Steven

   →→ Download Now ←← - Click to Rate File -
Like this download? Share it on Twitter → Copyright (c) 2022