Find out who or what keeps setting netlogon to disabled


  • My company has a relatively large VM environment. Lately one team keeps opening tickets every time a server reboots because netlogon has been set to disabled. This is creating a large amount of work. I am attempting to find a log stating who or what made this change and also set SCOM to notify prior to the machine being rebooted and the service stopping.
    Thursday, February 27, 2014 4:20 PM


  • Hiya,

    If I remember correct, there would be a system event log on changes to services. EventID 7040 Information.

    Thursday, February 27, 2014 7:25 PM