Queries for the ConfigurationData table

  • Article

Recent stopped auto services

Shows most recent services that were set to Auto but reported as being stopped.

ConfigurationData
| where ConfigDataType == "WindowsServices" and SvcStartupType == "Auto"
| where SvcState == "Stopped"
| summarize arg_max(TimeGenerated, *) by SoftwareName, Computer