IT Toolbox
IT Toolbox

Event ID 7036 — Change of,state of,service

TopicWindows Server →
View my favorites

A service has been switched to, started or stopped.

Source of event

Service Control Manager — Services category.

Possible causes

  • Normal start
  • Manual stop
  • Restarting, a service

Verifications to be carried out

  1. Check if change is expected
  2. Correlate with Event ID 1074 or an intervention

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036} -MaxEvents 50

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.

♡ 0