I would like to be able to monitor when the state of "Startup Type" for a particular service is changed from Automatic to Manual. I haven't been able to find an event that is triggered in event viewer when Startup Type is changed. Is there anyway I can add an event for this or would there be any other way to monitor this change?
Not sure about Windows 2003, but on Windows 7/2008 R2, event id 7040 is recorded in the system event log, with the following text:
"The start type of the xxxx service was changed from auto start to demand start."
Event ID 7040 — Basic Service Operations
http://technet.microsoft.com/en-us/library/cc756386%28v=ws.10%29.aspx
This is true for Windows 2003 as well, and the event is located in the system event log with a source of Service Control Manager.
You could use a product called EventSentry to monitor this service to get real time alerts, and it will even work with Windows 2000. It will also notify you if a service is installed, uninstalled, changed status (running to stopped), etc… You can find a download for the product here:
http://eventsentry.com/downloads
“Disclaimer: I work for NETIKUS.NET”