I found a situation where it would be useful to know who started SQL Server Service. First we did not know why it was stopped, it was not that urgent since this was a TEST instance but suddenly one day later we found that SQL Server Service was started. I look on Windows Event Log (System) and found the entry that mention that sql server was started. It says User: system. Any ideas? Thanks!

  • 1
    If it says it was started by "system" this could be many different things but is generally something such as a monitoring system such as scom. Do you have any of these types of things running in the environment? May 4, 2016 at 2:25
  • Thanks! Yeah, we do have SCOM on our environment. I'll research if it's configured to start the service if the service is stopped. But just to keep with the question, is that the only way to find the user who starts the service? Do you know any other option? Thanks! May 4, 2016 at 19:29
  • 1
    Unfortunately so, to the best of my knowledge. Once you hit "system" it's almost impossible to figure out. May 4, 2016 at 20:15


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.