Detect is when a windows service has been deleted

While there is no trace of service deletion in Event or Audit logs, what you can do is create a small console app that detects if a service exists and attach this app to Windows Task Scheduler such that it is scheduled to execute based on frequency or a Trigger that you can customize to your requirements such that you will receive an alert if a service has been added or removed etc..

The console app is designed such that on the first run, it logs all the services on the system and on the subsequent runs it will be tracking changes made on the services via servicesRemoved and servicesAdded, with this we can decide what action to take when a service has been modified

Console App: ServiceDetector.exe

static void Main(string[] args)
{
    var path = @"C:\AdminLocation\ServicesLog.txt";

    var currentServiceCollection = ServiceController.GetServices().Select(s => s.ServiceName).ToList(); //Queries the most current Services from the machine

    if (!File.Exists(path)) //Creates a Log file with current services if not present, usually means the first run
    {
        // Assumption made is that this is the first run
        using (var text = File.AppendText(path))
        {
            currentServiceCollection.ForEach((s) => text.WriteLine(s));
        }
        return;
    }

    // Fetches the recorded services from the Log
    var existingServiceCollection = File.ReadAllLines(path).ToList();

    var servicesRemoved = existingServiceCollection.Except(currentServiceCollection).ToList();
    var servicesAdded = currentServiceCollection.Except(existingServiceCollection).ToList();

    if (!servicesAdded.Any() && !servicesRemoved.Any())
    { Console.WriteLine("No services have been added or removed"); return; }

    //If any services has been added
    if (servicesAdded.Any())
    {
        Console.WriteLine("One or more services has been added");
        using (var text = File.AppendText(path))
        {
            servicesAdded.ForEach((s) => text.WriteLine(s));
        }
        return;
    }
    //Service(s) may have been deleted, you can choose to record it or not based on your requirements
    Console.WriteLine("One or more services has been removed");

}

Scheduling Task

Windows Start > Task Scheduler > Create Basic Task > Set Trigger > Attach your exe > Finish

You're right that deleting a Windows Service does cause an event to be added to the System Event Log (source: https://superuser.com/questions/1238311/how-can-we-detect-if-a-windows-service-is-deleted-is-there-an-event-log-id-for-i).

AFAIK there's no audit policy to audit the deletion of a service and I think if there were I think it would be listed here: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-process-tracking

I assume polling ServiceController.GetServices() is out of the question because your program might not be running when the service is uninstalled?

There are lots of ways to build instrumentation, until you learn what constitutes good instrumentation. My how-to is essentially taken directly from the Wikipedia entry https://en.wikipedia.org/wiki/Instrumentation.

Instrumentation How-to

http://www.powersemantics.com/e.html

• Non-integrated
• Primary data only
• Pull not push
• Organized by process
• Never offline

The solution to the problem of measuring indicators exists, but you're stuck conceptualizing how to also have "push-based" instrumentation signal another system. As my E article explains, instruments should always pull data never push it. Event-driven signalling is a potential point of failure you don't need.

To clear up any indecisiveness or doubts you may have about building a separate application, monitors are normally independent (non-integrated as Wikipedia says) processes. So saying your monitor "might not be running" means you have not chosen to build a real non-integrated monitor, one which is always on. Your consumer system doesn't correctly model instrumentation, because it integrates the check in its own process.

Separate these responsibilities and proceed. Decide how often the instrument should reasonably poll for deleted services and poll the data with a timer. If you use the API call simon-pearson suggested, you can also detect when services have been added. Of course, the monitor needs to locally cache a copy of the service list so that indicators can infer what's been added or removed.