IT Toolbox
IT Toolbox

Event ID 7045 — New service installed

TopicWindows Server →
View my favorites

A new Windows service has been registered.

Source of event

Service Control Manager — Services category.

Possible causes

  • Software installation
  • Agent or pilot
  • Persistence mechanism

Verifications to be carried out

  1. Identify Service Name and ImagePath
  2. Check the file editor
  3. Compare to Security 4697 event

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045} -MaxEvents 20

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.

♡ 0