Event ID 7045: a service was installed in the system

Event 7045 is written in the System log whenever a new Windows service is installed. Services start with Windows and usually run as SYSTEM – so a new service is one of the strongest ways to keep control of a machine, and remote-execution tools such as PsExec create one every time they run. It is on by default, which makes it one of the most useful events to check after a suspected break-in.

In short

What it is: a new service, with name, program path (Service File Name), start type and account.
System log, source Service Control Manager – on by default, no audit policy needed.
Security log twin: 4697 (audit subcategory Security System Extension).
Suspicious: PSEXESVC or random names, program paths in Temp, user or ProgramData folders, cmd /c or powershell in the path.

1. PowerShell: services installed recently

function Get-EventFields($e) { $d = [ordered]@{}; ([xml]$e.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }; [pscustomobject]$d }
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Service Control Manager'; Id=7045; StartTime=(Get-Date).AddDays(-30)} -ErrorAction SilentlyContinue |
  ForEach-Object { $f = Get-EventFields $_
    [pscustomobject]@{ Time = $_.TimeCreated; Service = $f.ServiceName; Program = $f.ImagePath; Start = $f.StartType; Account = $f.AccountName } } |
  Format-List

And the services that exist now, outside the Windows folder:

Get-CimInstance Win32_Service | Where-Object { $_.PathName -and $_.PathName -notmatch '\\Windows\\(System32|SysWOW64)\\' } |
  Select-Object Name, State, StartMode, StartName, PathName | Format-Table -AutoSize

2. Normal or attack?

Normal: during software installation or updates (drivers, antivirus, backup agents, printer software) – the program is under Program Files and the name matches the product.
Remote admin tools: PSEXESVC (PsExec) and similar services appear every time someone runs a command remotely. Fine if it was your admin, a key sign of lateral movement if not.
Suspicious: random or Windows-like names; program paths in C:\Windows\Temp, C:\Users\..., C:\ProgramData; cmd.exe /c, powershell -enc or rundll32 as the service program; a service created and deleted within minutes; drivers (kernel mode driver) you did not install.

If you find one: stop and disable it (Stop-Service, Set-Service -StartupType Disabled), keep the file for analysis, and look at the logons and share access (ADMIN$) around that time.

3. Let Coinetic watch it for you

Coinetic keeps the network side of a Server or PC in shape, so attackers rarely get as far as this:

A security check with plain explanations: open ports, risky settings and firewall rules nobody needs any more – each with a severity and a fix you can undo.
Firewall change watch: if something switches the firewall off or opens a port to everyone, Coinetic alerts you and names the program.
Logging kept on: Coinetic keeps the audit settings and the Security log size it needs, and reports audit settings that flood the log.
Ask AI (Pro + AI): “Which finding of the security check should I fix first, and why?”

Protect this Server or PC in 5 minutes

Download Coinetic, install, done: it starts protecting at once. 30 days free with all features, no payment details. From $20 per computer per year.

Start the free 30-day trial →

More guides: all Coinetic guides.

Frequently asked

Why does PsExec create a service?

PsExec copies PSEXESVC.exe to the target's ADMIN$ share, installs it as a service, runs your command through it and removes it afterwards. Each run logs a 7045.

What is the difference between 7045 and 4697?

Same information, different logs: 7045 is always in the System log, 4697 in the Security log when Security System Extension auditing is enabled.

Can a malicious service hide from 7045?

Changing the program path of an existing service does not create a 7045 (only a 7040 or registry change). That is why it is also worth listing all services outside the Windows folder now and then.