Say a normal user starts a service listening on a port. How can I automatically discover the service along with the user that started it?

TcpView from sysinternals will list what processes are listening on what ports. If the process is running under a user account you can look in task manager for the user name associated with the process name/PID.If the process is started as a service, itmay not be associated with a user account. In that case you need to enable auditing and process tracking to determine who started the service.

Hello, Thank you for your post here. Yes, you may count on the Process Explorer that you will be able to check the user account (security context) that the service run under. Process Explorer v11.33 http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx If you have any questions or concerns, please do not hesitate to let me know.