☰

Windows 10 事件日志中有关 Windows 模块安装程序服务的奇怪事件

tag-icon • tag-icon windows-10 event-viewer
Windows 10 事件日志中有关 Windows 模块安装程序服务的奇怪事件

我刚刚查看了事件查看器，因为我的设备总是断开连接并重新连接，所以我试图找出这是否是软件问题，或者 USB 电缆中的电线是否弄乱了，然后我发现了一些非常奇怪的条目。这是在 Windows 10 Home 64 位系统上

Log Name:      System
Source:        Service Control Manager
Date:          2024-02-16 11:31:38 AM
Event ID:      7040
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      DESKTOP-CA9265O
Description:
The start type of the Windows Modules Installer service was changed from auto start to demand start.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2024-02-16T16:31:38.9786775Z" />
    <EventRecordID>100903</EventRecordID>
    <Correlation />
    <Execution ProcessID="996" ThreadID="20380" />
    <Channel>System</Channel>
    <Computer>DESKTOP-CA9265O</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="param1">Windows Modules Installer</Data>
    <Data Name="param2">auto start</Data>
    <Data Name="param3">demand start</Data>
    <Data Name="param4">TrustedInstaller</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          2024-02-16 11:12:44 AM
Event ID:      7040
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      DESKTOP-CA9265O
Description:
The start type of the Windows Modules Installer service was changed from demand start to auto start.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2024-02-16T16:12:44.2737181Z" />
    <EventRecordID>100902</EventRecordID>
    <Correlation />
    <Execution ProcessID="996" ThreadID="16768" />
    <Channel>System</Channel>
    <Computer>DESKTOP-CA9265O</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="param1">Windows Modules Installer</Data>
    <Data Name="param2">demand start</Data>
    <Data Name="param3">auto start</Data>
    <Data Name="param4">TrustedInstaller</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          2024-02-16 11:12:40 AM
Event ID:      7040
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      DESKTOP-CA9265O
Description:
The start type of the Windows Modules Installer service was changed from auto start to demand start.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2024-02-16T16:12:40.0349188Z" />
    <EventRecordID>100901</EventRecordID>
    <Correlation />
    <Execution ProcessID="996" ThreadID="16768" />
    <Channel>System</Channel>
    <Computer>DESKTOP-CA9265O</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="param1">Windows Modules Installer</Data>
    <Data Name="param2">auto start</Data>
    <Data Name="param3">demand start</Data>
    <Data Name="param4">TrustedInstaller</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          2024-02-16 10:57:11 AM
Event ID:      7040
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      DESKTOP-CA9265O
Description:
The start type of the Windows Modules Installer service was changed from demand start to auto start.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2024-02-16T15:57:11.2390014Z" />
    <EventRecordID>100900</EventRecordID>
    <Correlation />
    <Execution ProcessID="996" ThreadID="15748" />
    <Channel>System</Channel>
    <Computer>DESKTOP-CA9265O</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="param1">Windows Modules Installer</Data>
    <Data Name="param2">demand start</Data>
    <Data Name="param3">auto start</Data>
    <Data Name="param4">TrustedInstaller</Data>
  </EventData>
</Event>

有人能想出任何合理的理由来解释为什么受信任的安装程序会将其启动类型从按需启动更改为自动启动，然后 15 分钟后将其改回按需启动，然后再过 4 秒又改回自动启动，然后再过 18 分钟又切换回按需启动吗？也许我只是有点偏执，但这里似乎有些不对劲......

答案1

这是普通的Windows 的行为，当 Windows 更新进程需要检查/下载/安装更新时，它会启动该进程。与 USB 设备无关，除非 Windows 不断尝试从 Windows 更新重新安装新驱动程序（您也会在系统日志中看到）。

例如，您还可能会看到相同的 7040 事件，表示“后台智能传输服务”（BITS）改变了其启动模式。

相关内容