01Fields in the event
- Service Name
- Service File Name
- Service Type
- Service Start Type
- Service Account
02How to use it
Flag a Service File Name outside the Windows and Program Files folders and a Service Account you do not expect, and compare the entry with the service's registry key. 7045 is the System log counterpart of 4697: when one of the two logs is missing or has been cleared, look for the installation in the other.
03Ordinary causes
Microsoft's page lists 7045 among the events that can show what was installed shortly before reboot trouble. Its own example is the installation of the Intel(R) Dynamic Application Loader Host Interface Service with a driver update (account LocalSystem, start type auto start), which the page reads as a possible cause of a bug check, not as a security event.
04Read it with
- 4697 A service was installed in the systemThe same installation is recorded in the Security log as 4697. 4697 names the account that installed the service in its Subject fields and depends on the Audit Security System Extension subcategory; the 7045 message labels on the cited page give only the account the service runs as. If either log is missing or was cleared, look for the installation in the other.
- 7040 The start type of a service was changed7045 records the start type a service was installed with; a later change of the start type is recorded by 7040. Compare the two for the same service name.
- 1074 A process initiated a restart or shutdownMicrosoft's page filters 7045 together with 1074, 41 and 6008 to build a reboot history, so a service installation can be placed on the same timeline as the restart it may have been followed by.
05Caveats
The cited page, a guide to system event logs, lists this event with the Service Control Manager source; unlike 4697 it is not documented there as tied to an audit subcategory. The listed names are labels from the message text, not XML field names. Filter on both event ID and source, since the same IDs are used by other sources.
07Sources
- Microsoft Learn — Troubleshoot unexpected reboots using system event logs checked 2026-10-23