Event ID 7036 not showing in Windows Event Log on Win10

After a service is stopped in Windows Server 2016 in the System Windows Event Log appears an event ID 7036 with a message like

The (ServiceName) service entered the (StatusName) state.

But in Windows 10 no "service stopped" event appears in the System Windows Event Log (no filters are applied).

Is there any way to turn these messages on in Windows 10?

1 Answer

It looks like 7036 event is missing from Windows desktop OS (starting from 8). However you can monitor process termination:

1. Enable Audit Policy to audit process tracking:

gpedit.msc -> Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies - Local Group -> Detailed Tracking -> Audit Process Termination.

2. Check for event 4689 in Security Event Log

Alternatively you may try this solution.

But in this case, you will get event 4546 not only when the service starts or stops, but whenever something is trying to access it (e.g. when Services applet is open).