Windows Security Log Event ID 601

601: Attempt to install service

On this page

• Description of this event
• Field level details
• Examples

A new service was installed by the indicated user and domain.

Service Name: the internal system name of the new service.Use "sc query" to get a cross reference of service names and their more familiar display names.

Service Type:

Service Start Type:

Service Account: this is the account that the service runs under.

User Name and Domain identify the user who installed the service.

While this event only monitors new services, you can audit existing service related events such as starts, stops and modifications with the Object Access category. To enable auditing on a service you can use a Security Template or the subinacl (resource kit) command.
 

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 601

• Service Name:
• Service File Name:
• Service Type:
• Service Start Type:
• Service Account:
• User Name:
• Domain:
• Logon ID:

Supercharger Free Edition

Your entire Windows Event Collection environment on a single pane of glass.

Free.

 

Mini-Seminars Covering Event ID 601 11 Ways to Detect System Intrusions with the Security Log Top 5 Daily Reports for Monitoring Windows Servers Building a Security Dashboard for Your Senior Executives Top 6 Security Events You Only Detect by Monitoring Workstation Security Logs

 

Upcoming Webinars Live, Hands-on Deep-Dive into LLM Hacking: Prompt Injection, Model Context Protocol and Skills AD Certificate Services: A Massive Chunk of Windows Security Functionality Finally Gets the Security Research It Deserves Linux Security: Locking Down Admin Access with SSH and Sudo Understanding Broken Object Level Authorization: The Quiet Access Control Failure Undermining Today’s Apps

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy