| Event Id | 601 |
| Source | Security |
| Description | Attempt to install service: Service Name: < Service Name> Service File Name: < Service File Name> Service Type: < Service Type> Service Start Type: < Service Start Type> Service Account: < Service Account> By: User Name: < User Name> Domain: < Domain> Logon ID: < Logon ID> |
| Event Information | Cause : This event is logged when a new service is installed by the user and User Name and Domain identify the user who installed the service. Resolution : Verify the user is authorised to install the service. |
| Reference Links | Alternate Event ID in Vista and Windows Server 2008 is 4697. |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.