Service Guardian

Windows service watchdog for developers. Detect configuration drift, automatically restore critical services, attribute changes to processes when Windows audit data is available, and export a local audit timeline.

MVP

svcguardian.ps1 is a self-contained PowerShell CLI. It protects a small policy of Windows services by checking their startup type against a JSON config.

Current commands:

.\svcguardian.ps1 init
.\svcguardian.ps1 protect LxssManager -StartupType Manual
.\svcguardian.ps1 status
.\svcguardian.ps1 check
.\svcguardian.ps1 check -Repair
.\svcguardian.ps1 watch -IntervalSeconds 10
.\svcguardian.ps1 timeline -Format markdown
.\svcguardian.ps1 doctor

Default files:

• Config: %ProgramData%\ServiceGuardian\config.json
• Timeline: %ProgramData%\ServiceGuardian\timeline.jsonl

Use -Config and -Timeline to point at project-local files while testing.

Quick Start

Run PowerShell as Administrator when you want Service Guardian to repair drift:

.\svcguardian.ps1 init
.\svcguardian.ps1 status
.\svcguardian.ps1 watch

init seeds a starter policy for installed common developer services using their current startup types as the baseline:

• LxssManager
• com.docker.service
• vmcompute
• sshd

Services that are not installed are skipped.

Add another service using its Windows service name:

.\svcguardian.ps1 protect ssh-agent -StartupType Automatic

If you omit -StartupType, Service Guardian records the service's current startup type:

.\svcguardian.ps1 protect vmcompute

Timeline Export

Service Guardian writes JSON Lines events as it detects missing services or startup-type drift. Export them as Markdown for issues or diagnostics:

.\svcguardian.ps1 timeline -Format markdown

Example event:

{
  "timestamp": "2026-07-07T02:20:00.0000000+05:30",
  "event": "startup_type_drift",
  "service": "LxssManager",
  "expectedStartupType": "Manual",
  "actualStartupType": "Disabled",
  "action": "restored",
  "actor": {
    "source": "Security/4657",
    "value": "C:\\Program Files\\Example\\tool.exe"
  }
}

Attribution Notes

Windows does not always record the executable that changed a service startup type. This MVP uses best-effort attribution:

• Security event 4657 can include the process name when registry auditing is enabled for the service key.
• System event 7040 can confirm that a service startup type changed, but it usually does not include the executable.
• When neither event is available, the timeline records attribution as unavailable.

Run:

.\svcguardian.ps1 doctor

to see whether the current shell is elevated and whether Security log lookup is available.

Roadmap

• Service Guardian
  • Monitor service startup type
  • Detect configuration drift
  • Restore expected configuration
  • Attribute changes to processes
  • Export audit timeline
  • Event Viewer integration
  • ETW tracing
  • PowerShell module
  • CLI
  • Tray application
• Installable Windows Service mode
• unprotect and list-known commands
• Recovery option protection
• Better event-log correlation and setup helpers for audit policy
• BugDNA-style diagnostic bundle export

Contributing

Contributions are welcome. See CONTRIBUTING.md, SECURITY.md, and CODE_OF_CONDUCT.md.

Service Guardian is released under the MIT License.