| Event Id | 4697 |
| Source | Microsoft-Windows-Security-Auditing |
| Description | A service was installed in the system. Subject: Security ID: < Security ID> Account Name: < Account Name> Account Domain: < Account Domain> Logon ID: < Logon ID> Service Information: Service Name: < Service Name> Service File Name: < Service File Name> Service Type: < Service Type> Service Start Type: < Service Start Type> Service Account: < Service Account> |
| Event Information | Cause : This event is logged when a new service is installed by the user and User Name and Domain identify the user who installed the service. Resolution : Verify the user is authorised to install the service. |
| Reference Links |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.