Is it possible to log who started or stopped a windows service?

Question

I have some windows services written in C#. When somebody stops or starts the service, I would like to be able to determine who is was and log that information.

I tried logging Environment.UserName but that evaluates to SYSTEM even on my local machine.

Also, for the time being these services are running on Windows 2000 server.

Answer 1

There probably isn't a way. Any of the normal .NET ways that you get at the environment's user are going to return the user whose credentials the service runs with (which will typically be SYSTEM, LOCAL SERVICE, NETWORK SERVICE, etc).

How I'd probably do it is poll the system to see if a user is logged in, and assume that user did it. Of course, this discounts services that are shut down by the system for some reason (presumably your service would not be), and can only help you narrow it down if more than one user is logged in at one time (but then, you could always log both of them).

Answer 2

Within the Event Viewer (Control Panel | Administrative Tools | Event Viewer) on the System tab the Service Control Manager logs who started and stop each event. I've just tested this myself and viewed the results. This leads me to two things:

1. You may be able to query or hook those events from the Service Control Manager as they happen, or
2. You can definitely just query the Event Viewer's "System" log to look for those events for your Service.

Hope that leads you to your solution.