ZEKASTRA

SecuritySystem and services

4697 · A service was installed in the system

Generated in the Security log when a new service is installed. Records the service name, binary path, type, start type and account.

01Fields in the event

  • SubjectUserSid
  • SubjectUserName
  • SubjectDomainName
  • SubjectLogonId
  • ServiceName
  • ServiceFileName
  • ServiceType
  • ServiceStartType
  • ServiceAccount

02How to use it

SubjectUserName shows the installing account. Flag ServiceFileName outside Windows or Program Files folders and compare it with the service's registry key.

03Caveats

Requires Audit Security System Extension; minimum Windows 10 / Server 2016. Later changes to path or account are not logged by this event.

05Sources

  1. Microsoft Learn — 4697(S) A service was installed in the system checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.