Good afternoon,
I have SAM setup and I want to be able to detect the install and uninstall of Windows Services on several machines.
Iv made the first part of the monitor to detect installs. Iv just made a Windows evet log monitor to look for ID 7045
However if I run a sc delete <span style="font-family:arial, helvetica, sans-serif;">i don't see anything in the event logs. This seems to be a limitation of the Windows OS. Does anyone have a way of monitoring for removed services?</span>
</code></p><p><code><span style="font-family:arial, helvetica, sans-serif;">This monitor was intended to be a broad monitor that just looks for installs and uninstalls. So I wont be looking for a specific service being removed.</span>