0

I just ran into a problem where several windows services related to products from entirely different companies were suddenly and inexplicable deleted (just the windows service registration itself - not the actual executables).

Everybody swears up and down that they didn't touch the machine - that the only thing anyone was doing on it at the time was running defrag.

The windows event log doesn't show anything that helpful that I can see - the only thing I could see even being possibly related were MSI runs, but those were for microsoft office, which I suspect are merely the result of the user logging in for the first time. (And before anyone asks, Office is installed on the machine because some programs running on the server use it behind the scenes to generate excel files via Interop).

Is there any way to track down / prove what or who caused the deletion of these services?

Edit - not sure it makes any difference, but the server is virtualized.

Edit - upon rebooting, the machine, it now appears that both these programs had their uninstallers run - since everything is gone except a few logs. Since these weren't msi installers, am I out of luck?

Nathan
  • 306
  • 1
  • 5
  • 13

1 Answers1

0

You probably are, unless you have logging configured. It might help inspecting Application Log closely, to exclude all possibilities.

Vick Vega
  • 2,398
  • 16
  • 22
  • When you say having logging configured - are you referring to something in addition to what is seen in the event viewer snapin? – Nathan Feb 14 '11 at 22:20
  • Yes, usually it's done through Auditing. This applied through local security, in case the server is stand alone, or through GPO. – Vick Vega Feb 15 '11 at 02:58