Event ID: 601

Attempt to install service

Attempt to install service:
    Service Name:        %1
    Service File Name:   %2
    Service Type:        %3
    Service Start Type:  %4
    Service Account:     %5
    User Name:           %6
    Domain:              %7
    Logon ID:            %8

Fields Definitions Insertion String
Service Name System name for the new service %1
Service File Name Full path of the executable %2
Service Type Indicate system use of service %3
Service Start Type Automatic - starts with the OS, Manual - starts via user, Disabled - Off %4
Service Account Account used by the service %5
User Name Account name attempting to install the service %6
Domain Domain of user %7
Logon ID Logon session %8


Service Type Key Value
KernelDriver 1 Kernel device driver
FileSystemDriver 2 A file system driver
Adapter 4 A service for a hardware device
RecognizerDriver 8 A driver used to resolve the file system available on the system
Win32OwnProcess 16 A Win32 service runs in a process itself
Win32ShareProcess 32 A Win32 service that can share a process with other services
InteractiveProcess 256 A service that talks to the desktop

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /category:"Detailed Tracking"

Operating Systems:
Windows 2003 Windows XP

Audit Category:
Detailed Tracking
Corresponding Events:

LEFT/RIGHT arrow keys for navigation

Back to List