如果您的Windows系统遭到破坏，并且希望分析服务是何时安装或修改的，那么您如何做到这一点？今天的超级用户问答帖子回答了一位好奇的读者的问题。

今天的问答环节是由SuperUser提供的，SuperUser是Stack Exchange的一个分支，是一个由社区驱动的问答网站分组。

记事本截图由Flyk（超级用户）提供。

问题

超级用户读者Lucas Kauffman想知道如何在Windows中找到服务的创建日期（或上次修改日期）：

If you have a compromised operating system that you are trying to ****yze for newly installed services or when services were installed, how do you do that? Where can I find the Creation Date for a particular service in the Windows registry?

如何找到Windows中服务的创建日期或上次修改日期？

答案

超级用户贡献者Flyk和Andrew Medico为我们提供了答案。首先，弗莱克：

There is no way to determine the Creation Date for a particular Windows service as both the services applet and Windows registry do not store any dates related to creation.

There is, however, a Last Modified Date that is hidden away from view (even in the Windows registry editor), but it can be accessed using RegQueryInfoKey. Since all Windows services are stored in the registry, you can check the Last Modified Date against the registry keys related to the service in question by looking in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services.

Alternatively, if you export the registry keys you want information about as text file, you will see the Last Modified Date for each key is written in the text file.

Finally, a solution using PowerShell to return the Last Modified Date has already been discussed on Stack Overflow.

接着是安德鲁医生的回答：

Starting with Vista, service creation is logged to the System Event Log under Service Control Manager Event ID 7045.

For example, the following command:

Produced the following event log entry:

有什么要补充的解释吗？在评论中发出声音。想从其他精通技术的Stack Exchange用户那里了解更多答案吗？在这里查看完整的讨论主题。