How to find which processes stop or start Windows Services

Windows Services being stopped or disabled is not very common, but sometimes it can happen. The biggest problem here is that there's no way to find out which process has stopped or updated Windows Services on Windows 10.

That's when you need a program that can test those services. It is useful with custom services that are prone to these problems.

Windows Service Auditor

Windows Service Auditor is a free program that allows you to monitor those services. Windows Service Auditor will let you know which process has stopped, started, deleted or updated Windows Services. It will keep a record of the user, time and progress of making any changes.

Find the process that stops or starts Windows Services

Windows Service Auditor is a free, portable application that allows you to perform detailed tests. It can also look at Windows Event Logs and provide more insight.

Note : Windows provides some tools, but they are not very helpful to the general user. Tools like Event Viewer and AuditPol provide detailed views, but are not useful. You need to be an expert to understand and debug those issues.

1. Initial setup

Windows Service Auditor is a portable application, so make sure to download it and place it where it is not deleted. Also, make sure to install the program to launch when the computer boots. Launch the application and you will see 2 sections List of Windows Services and Event logs . Event logs show any event logs connected to the selected service.

Download Windows Service Auditor
https://www.coretechnologies.com/products/WindowsServiceAuditor/

2. Enable advanced security checking

Windows does not include some advanced features in the default settings. You will need to enable advanced security checking to capture the details. The advantage of using Windows Service Auditor is that you can activate it immediately.

Click the Application menu and then select Enable Local Audit Policy . This option is automatically enabled by default, but if you want to turn it off, this is the menu you need to access.

3. Monitor a service

The final step is to select a service, then click the eye icon on the top menu to start tracking. Once enabled, notice the eye icon next to the service being monitored.

Select it and you will have details in the Events section . It will include all changes made by a program or user along with the timestamp. There is no way to enable this feature for many services and it will not work for all services, but only for those that are not under the control of the system.

You can also enable auditing for any service using the menu option available in the Service.