Better Windows Services: Track Service and Driver Changes in Windows 10 and 11

MakeUseOf's Afam Onyimadu covered the tool on November 13, 2026. This article adds the tool's own documentation and Microsoft's service and event references. It also adds some caveats about what the tool can and can't tell you.

The problem: a service setting can break a feature you use​

Take the example the MakeUseOf piece starts with. Microsoft's support guidance for Outlook says search can fail when the Windows Search service isn't running or isn't in a suitable startup mode. In that case, the Search tab's features are greyed out. Wait, that detail is from a different source, so here is the Microsoft guidance as documented: the Windows Search service should be running, and its startup type should be Automatic or Automatic (Delayed Start). Microsoft's page states that Disabled prevents the service from running.

That supports a general point: one service setting can break something visible. It does not prove that any particular third-party program caused it. The MakeUseOf account of a program that flipped Windows Search to Disabled comes from the author's reading of an older Microsoft article. I couldn't independently confirm that detail.

Not every change is suspicious, either. Microsoft's documentation explains that the Service Control Manager keeps the database of installed services and driver services, including how each should start. Windows also supports trigger-start services that run only when a system event calls for them. A service that is running today and stopped yesterday is often just Windows doing its job.

What Windows already gives you, and where it falls short​

Windows logs some of this. The weakness is that you have to dig for it.

• Event 7040 comes from the Service Control Manager in the System log. Its message reads "The start type of the %1 service was changed from %2 to %3." One independent reference says it can be triggered through sc config, Set-Service, the Services console, Group Policy or a service's own installer. That is useful, but it is a third-party analysis rather than Microsoft's own wording.
• Event 7045 records a newly installed service. Microsoft's Learn troubleshooting guide shows it with the service name, file path, type, start type and account.
• Event 7036 and similar entries record services entering running or stopped states. They crowd the same log and bury the entries you care about.

The log tells you an event happened. It doesn't hand you a clean picture of last week's configuration next to today's. The Services console shows only the current state, and it has no search or history.

How Better Windows Services works​

The project's site describes the tool as an independent, GPL-3.0 open-source program. It says Microsoft doesn't endorse it. The developer also discloses that it was built with an AI-assisted workflow, and MakeUseOf calls it a young, solo project. Treat it accordingly.

The core idea is the snapshot. A snapshot is a JSON file capturing every service and driver. Per the project, the fields include:

• startup type and running account
• launch path
• file hash and signer
• dependencies and triggers
• privileges and security descriptor

You can compare a snapshot against the live machine, or compare two snapshots. The diff reports configuration changes separately from running-state changes. The project's own example shows a Print Spooler start type moving from Manual to Automatic, labeled as configuration. Its Stopped-to-Running change is labeled as running state, not configuration.

One design choice is worth knowing about. If a field couldn't be read in one of the snapshots, the diff lists it as not compared instead of hiding the gap. A "no differences" result therefore means no difference in what both sides could see.

Step-by-step workflow​

1. Install the tool. It is offered as a GUI ZIP, a command-line ZIP, and an MSI installer. The project says the ZIP versions are self-contained and don't write to the registry.
2. Open the tool and click Audit, then Take snapshot.
3. Give the file a descriptive name, click Save snapshot, pick a location, and save the JSON file.
4. Repeat before big Windows updates or major software installs.
5. When something breaks, click Audit, then Compare with this machine, and choose your known-good snapshot.
6. Read the "In the snapshot" and "Now" columns. A start type moving from Manual to Automatic deserves a look. A service that has merely changed from Stopped to Running usually doesn't.
7. Use the search field in the comparison window to narrow rows. A Drivers page offers similar steps for drivers.

For scripting, the project documents a command-line tool called bws. Its snapshot create and snapshot diff commands make the same comparison. The --exit-code switch returns 5 when configuration differs, so a scheduled task could flag drift. The site also says bws history reads the System log to show who changed a start type or installed a service.

Filters and fixes​

The tool offers five filter categories: State, Startup type, Signature, "Disagrees with itself," and "About the entry." The Signature filter has Trusted, Not trusted and Could not check options.

It can also stop, start, restart, and change the startup type of services. Before acting, it shows a plan, including dependent services that would also stop. The project says the preview and the execution use the same plan.

Limits to keep in mind​

• Administrator rights. Looking doesn't need elevation, but changing settings does. Without elevation you may see fewer entries. Snapshots record whether they were taken without admin rights. Comparing snapshots taken at different privilege levels can make entries look removed when they weren't.
• Signature checks are clues. The project says certificate revocation isn't checked, because that would need network access. "Trusted" means the certificate chain was valid on that machine. Services hosted in svchost.exe also show less informative path and signer data.
• Local only. There is no remote management. To compare two machines, take a snapshot on each and diff the files.
• Drivers are read-only. The tool refuses operations on drivers, because stopping a kernel driver may not be reversible without a restart.
• Not antivirus. It is a configuration auditor, not a malware scanner.
• Not a live monitor. It compares snapshots you took. It doesn't watch continuously, and it doesn't name the process behind a change. Event logs may add context, but not always.
• Be careful remotely. The project's short list of essential services doesn't include Remote Desktop. Over a remote session, read the plan before running it.

The project's FAQ says it has no telemetry, update check, or crash reporting, and that it doesn't normally touch the network. The exception is an optional --follow-network mode, which is off by default. Requirements are 64-bit Windows 10 version 1809 or later, or Windows Server 2019 or later.

Bottom line​

Windows tells you what its services are doing now and logs some changes, but it has no built-in before-and-after view. A saved snapshot supplies one. It is a cheap habit before updates and installs. For admins, the command-line diff adds a way to catch drift. Just remember that a diff shows what changed, not why or who did it, so follow up with Event Viewer when the cause matters.