01Location
- SYSTEM hive: ControlSet00n\Services\<name>
- SYSTEM hive: ControlSet00n\Services\<name>\Parameters (e.g. ServiceDll)
02Questions it answers
- Which services and drivers are configured to start, and from which binaries or DLLs?
- Under which account does a service run?
- Was a service installed or modified recently (key time, event 4697)?
- Were security-relevant services disabled (Start = 4)?
03Format and versions
| Format | Registry key per driver or service with values ImagePath (REG_SZ), Start (REG_DWORD 0 Boot, 1 System, 2 Automatic, 3 On demand, 4 Disabled), Type (0x1 kernel driver, 0x2 file system driver, 0x10 own process, 0x20 shared process), ErrorControl, ObjectName, DisplayName and Description. |
|---|---|
| Applies to | All Windows NT-based systems; event 4697 is documented for Windows 10 and Windows Server 2016 and later. |
04Key fields
| Field | What it tells you |
|---|---|
| ImagePath | Path and file name of the service or driver image. |
| Start | Start type, shown as 'Startup Type' in the Services console. |
| Type | Driver or service type. |
| ObjectName | For services the logon account; for drivers the driver object name. |
| Parameters\ServiceDll | REG_EXPAND_SZ path of the DLL hosted by a shared service process. |
| ErrorControl / DependOnService | Failure handling and dependencies. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| Service key last written time | FILETIME (UTC) | Reflects the last change to the key, which may be an update rather than the installation. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Parse the Services key in every control set and compare against a baseline of the same Windows build.
- Review ImagePath and ServiceDll locations, start types and accounts for anomalies.
- Look for disabled security services and unusual Type or ErrorControl combinations.
- Correlate with event 4697, Amcache and Prefetch for installation and execution evidence.
07Interpretation pitfalls
- A configured service is not proof that it ran.
- Event 4697 requires the 'Audit Security System Extension' subcategory, and the logged account reflects installation-time configuration only.
- Malware may modify existing services (e.g. Start, ErrorControl, Type) instead of creating new ones.
09Sources
- Services and drivers libyal / winreg-kb · checked 2026-10-14
- HKLM\SYSTEM\CurrentControlSet\Services Registry Tree Microsoft Learn · checked 2026-10-14
- 4697(S): A service was installed in the system. Microsoft Learn · checked 2026-10-14
- Services and drivers ForensicArtifacts / artifacts-kb · checked 2026-10-14
- RECmd batch file Kroll_Batch.reb (key descriptions) Eric Zimmerman / Kroll (GitHub) · checked 2026-10-14