Configuring the Windows services rule

Windows Services rules are comparison-based rules that enable you to select a Windows Service from the source of the audit or snapshot specification, and then compare them with the target servers. The audit or snapshot specification compares the selected services with services on the target servers to determine whether the services exist and whether the services are started, stopped, or disabled. You cannot set a target or remediation value with this type of rule

To configure Windows Services audit rules:

1. Create a new audit. See using Creating an audit for ways to create an audit.
   
   (Optional) If you want to create this rule for a snapshot specification, see Creating a snapshot specification .
2. Select an Audit Source: Server, Snapshot, Snapshot Specification, or No Source.
   
   Some audit rules, such as Application Configuration and Windows User’s and Groups, must have a source.
3. In the Audit window, from the Views pane, select Rules > Windows Services.
4. In the content pane of the Audit window, expand the top level node in the Available for Audit section and select a Windows Service to create a rule for. You can select any available service for the rule; however, you cannot select the root folder for all Windows services.
5. Click the right arrow button to move the selected Windows Services into the Selected for Audit section. All items that you select will be used to audit or snapshot on the target server.
6. To finish configuring the audit, set the target servers, the schedule, and the notification for the audit.
7. Save the audit.
8. To run the audit, from the Actions menu select Run Audit. See Running an audit .