locked
How to find the services started / restarted time and the user who has restarted it? RRS feed

  • Question

  • How to find the services started / restarted time and the user who has restarted it?
    Regards, Dinesh.U
    Monday, October 4, 2010 9:34 PM

Answers

  • Hi Dinesh,

    Download and Install Process Explorer from the below link

    http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

    Once you have Process Explorer installed and running:


    In the taskbar menu select 'View' and check:
    'Show Process Tree' and the 'Show Lower Pane' options.
    Next right click on any column and 'select columns'
    Now click on the 'Process Performance' tab and
    check the 'Start Time' box.

    You should be able to see the user column be default and now the start time column should be visible

     

    All the Best!!!

     

    • Proposed as answer by Sam_HP Wednesday, October 6, 2010 3:01 PM
    • Marked as answer by Dinesh Udaya Thursday, October 14, 2010 1:10 AM
    Wednesday, October 6, 2010 2:03 PM
  •  You can get service start/stop times from the system event log, but it
    usually shows the user as SYSTEM or N/A account. You may need to cross
    reference times with the users who are logged in.
     

    -- Mike Burr
    • Marked as answer by Dinesh Udaya Thursday, October 14, 2010 1:11 AM
    Tuesday, October 5, 2010 11:58 PM
  • You can go to Event Viewer to setup a task to send you emails when certain log occurs (such as service reboot log). However as Mike mentioned, the user may be listed as System.
    Shaon Shan| TechNet Subscriber Support in forum| If you have any feedback on our support, please contact tngfb@microsoft.com
    • Marked as answer by Dinesh Udaya Thursday, October 14, 2010 1:10 AM
    Friday, October 8, 2010 9:01 AM

All replies

  •  You can get service start/stop times from the system event log, but it
    usually shows the user as SYSTEM or N/A account. You may need to cross
    reference times with the users who are logged in.
     

    -- Mike Burr
    • Marked as answer by Dinesh Udaya Thursday, October 14, 2010 1:11 AM
    Tuesday, October 5, 2010 11:58 PM
  • Hi Dinesh,

    Download and Install Process Explorer from the below link

    http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

    Once you have Process Explorer installed and running:


    In the taskbar menu select 'View' and check:
    'Show Process Tree' and the 'Show Lower Pane' options.
    Next right click on any column and 'select columns'
    Now click on the 'Process Performance' tab and
    check the 'Start Time' box.

    You should be able to see the user column be default and now the start time column should be visible

     

    All the Best!!!

     

    • Proposed as answer by Sam_HP Wednesday, October 6, 2010 3:01 PM
    • Marked as answer by Dinesh Udaya Thursday, October 14, 2010 1:10 AM
    Wednesday, October 6, 2010 2:03 PM
  • You can go to Event Viewer to setup a task to send you emails when certain log occurs (such as service reboot log). However as Mike mentioned, the user may be listed as System.
    Shaon Shan| TechNet Subscriber Support in forum| If you have any feedback on our support, please contact tngfb@microsoft.com
    • Marked as answer by Dinesh Udaya Thursday, October 14, 2010 1:10 AM
    Friday, October 8, 2010 9:01 AM