Event ID 7045: Service Installed
This event, logged to the System
channel, is produced when a new service is installed on the system.
Analysis Value
pageSecurity IdentifierpageFile PathOperating System Availability
Major Version | Support | Major Version | Support |
---|---|---|---|
Windows 11 | ✅ | Server 2019 | ✅ |
Windows 10 | ✅ | Server 2016 | ✅ |
Windows 8 | ✅ | Server 2012 | ✅ |
Windows 7 | ✅ | Server 2008 | ✅ |
Windows Vista | ✅ | Server 2003 | ❌ |
Windows XP | ❌ |
Artifact Location(s)
%SystemRoot%\System32\Winevt\Logs\System.evtx
Artifact Interpretation
Field | Interpretation | Reference |
---|---|---|
| This field provides the SID of the account that installed the new service. | |
| This field provides the full path to the executable that will be run when the new service is started. |
There is no indication from this event alone that it was installed locally on the system itself, and services may be installed remotely leveraging utilities such as sc.exe
. In the event that the new service was installed remotely, as EventID 4624: An account was successfully logged on event may be logged before the new service is installed with a LogonType
of 3.
Example
In the following example, the following command was executed on a domain controller:
This installed a new service on the system WKS10-01, generating the following EventID 4624: An account was successfully logged on event:
As well as the following Event ID 7045: Service Installed event in the System
channel:
This example was produced on Windows 10, Version 10.0.19044 Build 19044
Last updated