https://community.splunk.com/t5/Getting-Data-In/Monitor-Windows-Service-Startup-Type-Changes/m-p/156654#M31756 <P>Hey,</P> <P>I am monitoring some Windows Event Log data and I want to see from this any events where the 'startup type' is changed (e.g. from 'Manual' to 'Disabled' OR from 'Disabled' to 'Automatic')</P> <P>Is this possible? If so, how?</P> <P>Thanks in advance for your help</P> Thu, 08 May 2014 12:05:43 GMT Ant1D 2014-05-08T12:05:43Z https://community.splunk.com/t5/Getting-Data-In/Monitor-Windows-Service-Startup-Type-Changes/m-p/156654#M31756 <P>Hey,</P> <P>I am monitoring some Windows Event Log data and I want to see from this any events where the 'startup type' is changed (e.g. from 'Manual' to 'Disabled' OR from 'Disabled' to 'Automatic')</P> <P>Is this possible? If so, how?</P> <P>Thanks in advance for your help</P> Thu, 08 May 2014 12:05:43 GMT https://community.splunk.com/t5/Getting-Data-In/Monitor-Windows-Service-Startup-Type-Changes/m-p/156654#M31756 Ant1D 2014-05-08T12:05:43Z https://community.splunk.com/t5/Getting-Data-In/Monitor-Windows-Service-Startup-Type-Changes/m-p/156655#M31757 <P>I have found the answer:<BR /> <A href="http://technet.microsoft.com/en-us/library/cc756386(v=ws.10).aspx">http://technet.microsoft.com/en-us/library/cc756386(v=ws.10).aspx</A></P> <P>An event with ID=7040 is generated in the Windows Event (System) Logs whenever a service has its start type changed.</P> Thu, 08 May 2014 13:24:12 GMT https://community.splunk.com/t5/Getting-Data-In/Monitor-Windows-Service-Startup-Type-Changes/m-p/156655#M31757 Ant1D 2014-05-08T13:24:12Z