{"id":10171,"date":"2021-01-10T06:56:20","date_gmt":"2021-01-10T14:56:20","guid":{"rendered":"https:\/\/www.coretechnologies.com\/blog\/?p=10171"},"modified":"2021-09-24T14:18:15","modified_gmt":"2021-09-24T21:18:15","slug":"what-services-changed","status":"publish","type":"post","link":"https:\/\/www.coretechnologies.com\/blog\/windows-services\/what-services-changed\/","title":{"rendered":"Q&A: What changed with my Windows Services?"},"content":{"rendered":"
\"Q&A:<\/div>\n
\n  How can I tell if someone updated the services on our Windows 2019 server? Do you have any tools for that?<\/p>\n

— Sheldon P.<\/p>\n<\/div>\n

Hi Sheldon.<\/p>\n

Since Windows Services run with high privileges, it’s very important to keep an eye on them. And because of their inherent power, services are a prized target for bad actors looking to hack your system.<\/p>\n

Indeed, 2020’s SolarWinds supply chain exploit<\/a> — one of the worst attacks in the past decade<\/a> — featured a rogue Windows Service depositing malware in the background. A periodic review of the list of services could have identified the compromise months earlier.<\/p>\n

Anyway, our free Windows Service Auditor<\/a> is an excellent monitoring tool that can help you in your situation. Follow these instructions to keep a watchful eye on your mission-critical servers.<\/p>\n

1. Download & run Windows Service Auditor<\/h2>\n

Windows Service Auditor<\/a> is portable application, meaning that you don’t need to install it. Simply download the executable file and place it in a folder where you can easily find it.<\/p>\n

Double-click the file to start it. In a few seconds, a window listing all your Windows Services will appear:<\/p>\n

\"Windows<\/a><\/div>\n

2. Update your computer’s security policy to allow advanced auditing<\/h2>\n

By default, Windows does not keep track all changes made to Windows Services. That capability must be enabled via advanced security audit policies<\/a>. Specifically, you need to watch for:<\/p>\n