I have a production server where an application is experiencing an issue. The psexec service is marked for deletion and I want to try and tie the deactivation of the service to the start of the issue.
Where would the removal of the service be logged or what would be the ID in the event log?
Thanks
If your application relies on the psexec service, then it would make sense that it is experiencing issues if the psexec service is marked for deletion.
PSEXEC uses a temporary service to launch the process (usually) remotely. Once the remote process exists, the psexec service is removed again.
Unfortunately, Windows doesn't really like services being created and removed a lot, and after a certain number of times (not sure what the number is) of the same service being installed & uninstalled, it will mark the service for deletion and lock it.
At that point you have to restart the service, that is the only way I'm aware of that will delete the service and let you re-create it.