ZEKASTRA

SystemSystem and services

7040 · The start type of a service was changed

Logged by the Service Control Manager when a service's start type changes, for example from automatic to disabled.

01Fields in the event

The cited Microsoft page does not list field names for this event.

02How to use it

A change to disabled for a security or logging service, or to automatic for an unknown service, is relevant to defence evasion and persistence questions.

03Caveats

Windows components change start types routinely (for example during updates). Cited from archived Windows Server 2008 R2 documentation.

05Sources

  1. Microsoft Learn — Event ID 7040 — Basic Service Operations checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.