How can the process/service that started or stopped a service be determined?
For example, I am finding that recently, the Computer Browser, Server, and Workstation services (as well as the function-discovery services) keep starting. I stop them, but then a few minutes later, they are running again. I have already tried disabling things like network shares, NetBIOS, Home Group, and every related thing that I can think of, but this (new) behavior is frustrating, and all the more so because I don’t know what is starting them. If I could figure out what process/service is starting them, then I would at least have a hint of where to look.
No, the Windows Event Log is not helpful because it says nothing about who/what started the service; the most information it gives is that Source field usually says Service Control Manager, but that says nothing about what asked the SC to start/stop the service.
Is there a way to have the Service Controller log state changes or something?