Important Notice: Our web hosting provider recently started charging us for additional visits, which was unexpected. In response, we're seeking donations. Depending on the situation, we may explore different monetization options for our Community and Expert Contributors. It's crucial to provide more returns for their expertise and offer more Expert Validated Answers or AI Validated Answers. Learn more about our hosting issue here.

Can RootCause trace System Services which are automatically started when the machine is booted?

0
Posted

Can RootCause trace System Services which are automatically started when the machine is booted?

0

Yes. However, there are a couple unique things about tracing System Services that you need to keep in mind: • Unlike all other processes, you will _not_ see an APP_START event in the RootCause log when a System Service starts. So, if you want to trace a System Service, you must manually Register it (either with the “rootcause new” command or the RootCause GUI’s Workspace->New dialog), and thereafter you will see APP_TRACED events for it in the RootCause log. • Since System Services can run as any user (most notably LSA, or the System Account), you must insure that the RootCause Workspace grants write access to the user that the Service will run as.

Related Questions

What is your question?

*Sadly, we had to bring back ads too. Hopefully more targeted.

Experts123