Adeegga Windows^{(Windows Service)} in la joojiyo ama la joojiyo maaha wax caadi ah, laakiin way dhici kartaa mararka qaarkood. Dhibaatada ugu weyn ee halkan ka jirta ayaa ah in aysan jirin qaab lagu ogaan karo Habka^(Process) uu joojiyay ama cusbooneysiiyay Adeegyada Windows^{(Windows Services)} ee Windows 10 . Halkaas oo aad uga baahan tahay barnaamij xisaabin kara adeegyada noocaas ah. Waxay la socotaa adeegyo khaas ah oo aad ugu nugul arrimahan. Hantidhawrka Adeegga Windows^{(Windows Service Auditor)} waa barnaamij bilaash ah oo kuu ogolaanaya inaad la socoto adeegyadan. Hantidhawraha Adeegga Daaqadaha^{(Windows Service Auditor)} ayaa kuu sheegi doona habka uu istaagay, bilaabay, la tirtiray, ama la cusboonaysiiyay Adeegyada ^(Services)Windows . Waxay kaydin doontaa isticmaalaha, wakhtiga, iyo nidaamka sameeyay isbeddel kasta.

Soo hel^(Find) habka joojiyay ama bilaabay Adeegyada ^(Services)Windows

Hantidhawrka Adeegga Daaqadaha^{(Windows Service Auditor)} waa bilaash, codsi la qaadan karo kaasoo kuu ogolaanaya inaad samayso xisaab hubin faahfaahsan. Waxa kale oo ay baari kartaa Diiwaanka Dhacdooyinka Dhacdooyinka Windows^{(Windows Event Logs)} si ay u bixiso aragti fiican. Daaqadaha waxay bixiyaan qalabyada qaar, laakiin ma caawiyaan macaamilka guud. Aaladaha sida Event Viewer iyo AuditPol waxay bixiyaan aragti tafatiran, laakiin ma caawiyaan. Waxaad u baahan tahay inaad khabiir noqoto si aad u fahamto oo aad u saxdo arrimahaas.

Tilmaamaha Xisaabiyaha Adeegga Daaqadaha

• Waxay la shaqaysaa kombayuutarrada domain-ka, siyaasadaha hanti dhawrka maxaliga ah iyo kuwa caalamiga ah
• Raad raac barnaamijkee joojiyay ama tirtiray Adeegga Windows^{(Windows Service)}
• Goorma ayaa adeeggu bilaabmay iyo goorma ayuu adeeggu bilaabmay
• Cilad kasta oo bilawga ah ee adeegyada

Sida loo isticmaalo Hantidhawrka Adeegga Windows

Maadaama kani yahay adeeg la socodka, ma samayn karo wax walba kaligiis. Waa inaad doorataa adeegga la raadinayo. Iyada oo ay la socoto, waad joojin kartaa, bilaabi kartaa adeegyada haddii loo baahdo. Waa kuwan sida loo isticmaalo xisaabinta adeegga.

1] Dejinta hore

Waa codsi la qaadi karo, markaa hubi inaad soo dejiso oo ku hayso meel aan laga tirtirin. Sidoo kale, iska hubi inaad dejiso si uu u bilaabo kombuyuutarku, si aanay xisaabintu u seegin la socodka. Bilaw arjiga, oo waxaad arki doontaa laba qaybood -Liiska Adeegyada ^(Services)Windows , iyo dhacdooyinka dhacdooyinka^(Event) . Dambe wuxuu muujinayaa diiwaan kasta oo dhacdo ah oo ku xiran adeegga la doortay.

2 ] Daro Hanti-dhawrka Amniga Sare^{(] Enable Advanced Security Auditing)}

Daaqadaha^(Windows) ma la socdaan qaar ka mid ah sifooyinka horumarsan sida goobaha caadiga ah. Waxaad u baahan doontaa inaad awood u siiso hanti-dhawrka amniga sare si aad u qabsato tafaasiisha. Waxa wanaagsan ayaa ah in la isticmaalo Hantidhawrka Adeegga Windows^{(Windows Service Auditor)} ; waxaad awood u yeelan kartaa isla markaaba.

Guji^(Click) liiska Codsiga^{(Application)} ka dibna dooro "Enable Local Audit Policy." Doorashadan si otomaatig ah ayaa loogu suurtagelinayaa si caadi ah, laakiin haddii aad rabto inaad joojiso, kani waa menu-ka aad u baahan tahay inaad gasho. Awoodsiinta tan, Windows hadda waxay la socon doontaa xisaabinta iyadoo ku saleysan kuwa soo socda

• Helitaanka Shayga Kale
• Gacan ku haynta
• Kordhinta Nidaamka Amniga

3] La Socod Adeeg

Talaabada ugu danbeysa waa in aad doorato adeeg,kadibna ku dhufo calaamadda "Isha" ee ku taal liiska sare si aad u bilowdo la socodka. Marka la furo, u fiirso astaanta "Isha" ee ku xigta adeegga la kormeerayo. Dooro, oo waxaad heli doontaa faahfaahinta qaybta Dhacdooyinka. Waxa ku jiri doona dhammaan isbeddellada uu sameeyo barnaamij ama isticmaale oo ay weheliso shaambada wakhtiga. Ma jirto qaab loogu suurtagelin karo adeegyo badan, mana shaqeyn doonto dhammaan adeegyada, laakiin kaliya kuwa aan hoos imaan nidaamka xakamaynta. Siyaasadda hantidhawrka ee jirta, Windows waxay qaban doontaa dhacdooyin xisaabeedka faahfaahsan mar kasta oo qof isku dayo inuu bilaabo, joojiyo, ama cusboonaysiiyo adeeggaaga.

Waxa kale oo aad awood u siin kartaa hanti-dhawrka adeeg kasta adiga oo isticmaalaya ikhtiyaarka menu-ka ee adeegyada hoos yimaada.

Sida Hantidhawrka Adeegga Windows^{(Windows Service Auditor)} uu ugu shaqeeyo Kombiyuutarrada Domain -ka^(Domain)

Inta aad awood ugu yeelan karto kombiyuutar kasta oo ka mid ah domain-ka, waxaa jira hal cillad. Isbeddel kasta oo uu sameeyo Hantidhawraha Adeegga Windows^{(Windows Service Auditor)} waa la beddeli doonaa marka xigta ee seerfarku soo cusboonaysiiyo siyaasadda. Waa inaad gacanta ku cusboonaysiisaa Siyaasadda Hanti-dhawrka Caalamiga ah^{(Global Audit Policy)} mar labaad si aad awood ugu yeelato hanti-dhawrka sare. Microsoft waxay haysaa dukumeenti tafatiran oo ku saabsan sida aad u cusboonaysiin karto ^{(detailed documentation)}Siyaasadda^(Policy) Hanti-dhawrka ee caalamiga ah .

Si la mid ah tafatirka Siyaasadda^(Policy) Maxaliga , waxaad u baahan doontaa inaad habayso nidaamka si aad u xisaabiso dhacdooyinka Galitaanka Shayga^{(Object Access)} Kale ,  Gacan-ku-haynta^{(Handle Manipulation)} , iyo  Kordhinta Nidaamka Amniga^{(Security System Extension)} . Waxay ku hoos jirtaa Settings Security^{(Security Settings)} .

Ka soo deji bogga rasmiga ah^{(official page)} .

Waxaan rajeynayaa in boostadu ay fududahay in la raaco, oo aad awooday inaad karti u siiso Hantidhawrka Amniga Sare ee^{(Advanced Security Auditing )} Adeegyada Windows Windows 10.

How to find which process stopped or started Windows Services

Windows Service getting stopped or disabled is not very common, but can happen at times. The biggest problem here is that there is no way to find out which Process stopped or updated the Windows Services on Windows 10. That is where you need a program that can audit such services. It comes in handy with custom services that are more prone to these issues. Windows Service Auditor is a free program that allows you to keep track of such services. Windows Service Auditor will tell you which process stopped, started, deleted, or updated Windows Services. It will keep a log on the user, time, and the process which made any change.

Find which process stopped or started Windows Services

Windows Service Auditor is a free, portable application that allows you to perform detailed auditing. It can also probe the Windows Event Logs to give better insight. Windows do offer some tools, but they don’t help a general consumer. Tools such as Event Viewer and AuditPol provides a detailed view, but they are not helpful. You need to be an expert to understand and debug those issues.

Features of Windows Service Auditor

• Works with domain computers, local and global audit policies
• Track which program stopped or deleted Windows Service
• When was the service started and at what time did the service start
• Any startup error for the services

How to use Windows Service Auditor

Since this is a monitoring service, it cannot do everything on its own. You will have to choose which service should be tracked. Along with it, you can stop, start services if needed. Here is how to use setup auditing of the service.

1] Initial Setup

It’s a portable application, so make sure to download and keep it at a place from where it doesn’t get deleted. Also, make sure to set it to launch as the computer starts, so the auditing doesn’t miss tracking.  Launch the application, and you will get to see two parts—List of Windows Services, and Event logs. The later reveals any event log connected to the selected service.

2] Enable Advanced Security Auditing

Windows don’t keep track of some of the advanced features as the default settings. You will need to enable advanced security auditing to capture the details. The good thing is that using Windows Service Auditor; you can enable it right away.

Click on the Application menu and then select “Enable Local Audit Policy .” This option is automatically enabled by default, but if you wish to disable it, this is the menu you need to access. Enabling this, Windows will now monitor auditing based on the following

• Other Object Access
• Handle Manipulation
• Security System Extension

3] Monitor a Service

The last step is to select a service, and then click on the “Eye” icon on the top menu to start monitoring it. Once enabled, notice an “Eye” icon next to the service which is being monitored. Select it, and you will have details in the Events section. It will include all the changes made by a program or a user along with a timestamp. There is no way to enable it for multiple services, and it will not work for all services, but only those that are not under system control. The audit policy in place, Windows will capture detailed audit events whenever anyone tries to start, stop, or update your service.

You can also enable auditing for any service using the menu option available under services.

How Windows Service Auditor works on Domain Computers

While you can enable it on any computer which is part of the domain, there is one drawback. Any changes made by Windows Service Auditor will be overwritten the next time the server refreshes the policy. You will have to manually update the Global Audit Policy again to enable advanced auditing. Microsoft has detailed documentation on how you can update the global Audit Policy.

Just like Local Policy editing, you will need to configure the system to audit events in the Other Object Access, Handle Manipulation, and Security System Extension. It is available under Security Settings.

Download it from the official page.

I hope the post was easy to follow, and you were able to enable Advanced Security Auditing for Windows Services on Windows 10.

Related posts

• Sida loo sahlo Debug loging ee adeega Netlogon Windows 10

• Adeegga wareejinta garaadka ee asalka ah oo aan shaqaynayn Windows 11/10

• Waa maxay Adeegga Caafimaadka Cusboonaysiinta Windows (WaaSMedicSVC.exe)?

• Sida loo awood ama u joojiyo Adeegga Caawinta IP gudaha Windows 10

• Dhibaato ku rarida adeega ka warbixinta Cilada Windows

• Ka ilaali adeega Windows ka saxaarada nidaamka adoo isticmaalaya ServiceTray

• Adeegga Warbixinta Cilada Microsoft Windows gudaha Windows 11/10

• Bixiyaha Adeegga Cryptographic Windows ayaa sheegay khalad

• Sida loo daahiyo rarka adeegyada gaarka ah ee gudaha Windows 11/10

• Adeegyada Desktop Fog waxay sababtaa CPU Sare gudaha Windows 11/10

• Sida loo xannibo mareegaha dadka waaweyn Windows 10 iyadoo la adeegsanayo Adeegyada DNS

• Wadaagista Xidhiidhka Internetka oo aan shaqaynayn Windows 10

• Sida looga saaro Adeegyada Camp Boot Windows on Mac

• Calankii dib-u-kicinta otomaatiga ah lama dejin karo - Cilad adeegga Windows

• Sida loo hagaajiyo adeegyada maqalka ee aan ka jawaabin Windows 10

• Hagaaji Adeegga Cusbooneysiinta Windows Server Code 0x80072EE6

• Hagaaji adeegyada iyo abka kontoroolka isticmaalka CPU sare ee gudaha Windows 11/10

• Hel Ku-tiirsanaanta Adeegga Daaqadaha | Si toos ah dib ugu bilow Adeegyada

• Sida loo suurtageliyo ama loo joojiyo Adeegga Rakibaadaha Windows 11/10

• Adeegyada Windows kuma bilaaban doonaan Windows 11/10