Event ID 7040 — Type of startup of a modified service

The mode of starting a service has been changed.

Source of event

Service Control Manager — Services category.

Possible causes

• Administrative change
• Installation or updating
• Persistence impairment

Verifications to be carried out

1. Identify service
2. Compare old and new mode
3. Check author via security logs if available

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='System'; Id=7040} -MaxEvents 20

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.