How to See Which Windows Services Are Starting or Stopping
How to See Which Windows Services Are Starting, Stopping, or Crashing
Windows relies on hundreds of background services to perform everyday tasks.
These services handle:
- Networking
- Printing
- Updates
- Security
- Bluetooth
- Audio
- Remote access
- Database operations
Most users never interact with them directly.
However, when troubleshooting performance problems, startup delays, application failures, or unexpected reboots, understanding which services are starting and stopping can be extremely valuable.
Many users open the Services console expecting to see a history of service activity. Unfortunately, the Services tool only shows the current state.
To see what happened in the past, you need to use Windows logging and monitoring tools.
This guide explains how to track service activity, identify crashes, and monitor service startup behavior.
What Are Windows Services?
Windows services are background programs that run independently of user applications.
Examples include:
- Windows Update
- Print Spooler
- Bluetooth Support Service
- Windows Defender
- DHCP Client
- Windows Time
Unlike normal applications, services often start automatically when Windows boots.
Why You Might Need Service History
Common troubleshooting scenarios include:
- Slow startup
- Services randomly stopping
- Applications failing unexpectedly
- Server instability
- High CPU usage
- Failed updates
- Missing network connectivity
Knowing exactly when a service started or stopped often reveals the root cause.
Method 1: Use Event Viewer
The most useful built-in tool is Event Viewer.
Step 1
Press:
Windows + X
Select:
Event Viewer
Step 2
Navigate to:
Windows Logs → System
Step 3
Look for events generated by:
Service Control Manager
This component records:
- Service starts
- Service stops
- Service failures
- Service restarts
Important Event IDs
| Event ID | Description |
|---|---|
| 7035 | Service control request sent |
| 7036 | Service started or stopped |
| 7031 | Service terminated unexpectedly |
| 7000 | Service failed to start |
| 7001 | Service dependency failure |
| 7023 | Service terminated with error |
These event IDs are among the most useful when troubleshooting service-related issues.
Method 2: Filter Service Events
Event Viewer can contain thousands of entries.
To narrow results:
Step: Select Filter Current Log.
Step: Enter:
7031,7035,7036,7000,7001,7023
Step: Apply filter.
This displays primarily service-related activity.
Method 3: Use Services Console
Open:
services.msc
The Services console shows:
- Running services
- Stopped services
- Startup types
However, it does not provide historical data.
Think of it as a real-time status dashboard rather than a history tool.
Method 4: Use PowerShell
To view running services:
Get-Service
To view a specific service:
Get-Service wuauserv
Example:
Get-Service | Sort Status
PowerShell is particularly useful for administrators managing multiple systems.
Method 5: Monitor Services in Real Time
Open:
Resource Monitor
or
Task Manager
You can observe:
- Running processes
- Resource usage
- Service associations
This helps identify services causing performance problems.
How to Identify Services That Keep Crashing
Look for recurring Event IDs:
| Event ID | Meaning |
| 7031 | Unexpected termination |
| 7023 | Service-specific error |
| 7024 | Service failure |
| 7009 | Startup timeout |
Repeated occurrences usually indicate:
- Corrupted files
- Missing dependencies
- Driver issues
- Permission problems
Advanced Troubleshooting
Check Service Dependencies
Open:
services.msc
Select a service.
Open:
Properties → Dependencies
A dependent service failure can trigger multiple service errors.
Run System File Checker
Open Administrator Command Prompt:
sfc /scannow
Corrupted system files frequently cause service instability.
Run DISM
If SFC reports problems:
DISM /Online /Cleanup-Image /RestoreHealth
Then rerun:
sfc /scannow
Compare Service Monitoring Tools
| Tool | Best For |
| Services.msc | Current status |
| Event Viewer | Historical events |
| PowerShell | Automation |
| Task Manager | Resource usage |
| Resource Monitor | Performance analysis |
Prevention Tips
Monitor Critical Services
Review service logs periodically on important systems.
Keep Windows Updated
Updates frequently resolve service-related bugs.
Avoid Unnecessary Service Tweaks
Disabling random services often creates instability.
Create Restore Points
Before modifying service configurations.
Review Event Viewer Regularly
It often provides early warning signs of problems.
When troubleshooting Windows problems, understanding service activity can reveal issues that would otherwise remain hidden.
Although Services.msc only shows current status, Event Viewer provides detailed historical records of service starts, stops, failures, and restarts.
For most users, Event Viewer is the best place to begin. For administrators and advanced users, PowerShell and Resource Monitor provide additional insight into how Windows services behave over time.
Frequently Asked Questions (FAQ)
Can I see a history of services starting and stopping?
Yes. Event Viewer records service activity through Service Control Manager events.
Which Event ID shows a service started?
Event ID 7036 commonly records service state changes.
How do I know why a service crashed?
Review Event Viewer for related error entries and service-specific messages.
Does Services.msc show service history?
No. It only shows the current state of each service.
Can PowerShell monitor services?
Yes. PowerShell provides powerful tools for viewing and managing services.