Is there a way for an application to get notified that a specific service is set to disabled? I have a NT service and I want to "catch" this event and keep that time for later use.
Any thoughts on how to do this?
Thanks
You ought to be able to do something in WMI to do with that. I think that you can subscribe to the __InstanceModificationEvent notification for the particular instance of Win32_Service that you're interested in.
On the other hand, if someone's going to stop and disable the service, they'll just stop and disable the process monitoring it. So you're not going to win, anyway.
Why don't you just secure the service ACL so that only Administrators can stop and disable it? This is, in fact, the default anyway. And if the user's got admin privileges, you've already lost.