Audit the starting and stopping of the service via subinacl.exe
Z Edward Ziots Network Engineer Lifespan Organization MCSE,MCSA,MCP+I, ME, CCA, Security +, Network + [email protected] Phone:401-639-3505 ________________________________ From: Christopher Bodnar [mailto:[email protected]] Sent: Friday, June 26, 2009 11:05 AM To: NT System Admin Issues Subject: RE: WTF? Did you install any updates? Chris Bodnar, MCSE Sr. Systems Engineer Distributed Systems Service Delivery - Intel Services Guardian Life Insurance Company of America Email: [email protected] Phone: 610-807-6459 Fax: 610-807-6003 ________________________________ From: [email protected] [mailto:[email protected]] Sent: Friday, June 26, 2009 10:52 AM To: NT System Admin Issues Subject: WTF? Ok, how do I find what did this to BITS? I changed BITS to manual start almost 12 hours earlier... Event Type: Information Event Source: Service Control Manager Event Category: None Event ID: 7040 Date: 6/26/2009 Time: 4:30:05 AM User: NT AUTHORITY\SYSTEM Computer: SERVER Description: The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. David Lum // SYSTEMS ENGINEER NORTHWEST EVALUATION ASSOCIATION (Desk) 971.222.1025 // (Cell) 503.267.9764 ________________________________ This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
