Event ID 7045: A Service was Installed in the System [Fix]

The Event ID 7045 denotes that a service was installed on your server. This might be by one of your users or sometimes a hacker that gained backdoor access to your server.

While this issue might look horrendous, it can be fixed by performing a few tweaks here and there. In this detailed guide, we will show you how to get rid of this prompt for good, just like we did with Event ID 16.

What is Event ID 7045?

The Event ID 7045 shows that the system indicated installed a new service on your server. The subject of this prompt is usually the local system where the service was installed as part of the native Windows components.

Hence, it is hard to determine the person that made the change. This event can be worrisome if the new service is not from any of the systems on your server.

Also, it might denote a breach if the new service registers unusual resource usage. But you have nothing to worry about if you can identify the new service.

How can I fix Event ID 7045?

Before exploring the solutions in this section, below are some of the basic troubleshooting steps to apply:

• Disable or delete any new service.
• Update all software on internet-facing hosts.

If the event persists, you can now proceed to the fixes below:

1. Configure audit policies

1. Sign in to your server as the Domain Administrator.
2. Now, launch the Group Policy Management Editor following the path below: Server Manager > Tools > Group Policy Management
3. Next, expand the Domain Controllers Organizational Units section and right-click Default Domain Controllers Policy.
4. Choose Edit. Note that you can use the Default Domain Controllers Policy or a dedicated GPO to set these policies.
   
5. On the new window, go to: Computer Configuration > Policies > Windows Settings > Security Settings
6. Depending on the policy you want to change, do the following for Advanced Audit Policy Configuration:
   • Navigate to Advanced Audit Policy Configuration > Audit Policies.
     
   • Under Audit Policies, edit the required policies and choose Configure the following audit events for both Success and Failure events.

If you are sure that Event ID 7045 is not a major problem, you can configure your audit policies to ignore it. Also, if you think there is a backdoor leak, you can change the audit policies to prevent it.

2. Scan for malware

If the new service causing the Event ID 7045 is leading to problems on your server, it might be a malicious service. What you need to do is to perform a full malware scan with a trusted antivirus to make sure the system is safe.

For instance, the recommended antivirus can offer multilayered virus protection and a higher detection rate for complex malware attacks.

⇒ Get ESET HOME Security Essential

However, if you know the specific service causing the problem, you must delete it before performing a malware scan.

With this, we can now conclude this guide on Event ID 7045. All you need to do now is to follow the instructions carefully, and things should be back to normal.

In the same vein, if you are getting the Event ID 5145 prompt, check our detailed guide to fix it quickly.

Feel free to let us know the solution that helped you fix this issue in the comments below.