Section 8: Service Failures

The Big Picture: Detective Work

Sometimes a service refuses to start, or it starts and then quits. You see a pop-up with a number, or you find a red entry in a log. This section teaches you to read the clues and find the cause, step by step, without breaking anything.

 Symptom ──► Error code / message ──► Event log entry ──► Check the usual suspects ──► Fix

8.1 Common Failure Causes

What it is: A short list of the reasons services fail. Most problems fit one of these.

Error 1053 explained. When the SCM starts a service process, the process has to report in within a time limit (about 30 seconds by default). If it is too slow (a heavy start, a stuck disk) or it was never written as a real service, the SCM gives up. Section 9 shows exactly what the service must do in that time.

Error 1068 explained. The service you want depends on another one (Section 4). That other one is disabled, missing, or failed. Fix the dependency, then retry.

Error 1069 explained. The account saved with the service no longer works. The password changed, the account was locked, or the account lacks the "Log on as a service" right (Section 5.4). Re-enter the correct password.

Windows tip: Messages like "Error 1053" may appear in services.msc, in sc start (it prints the number) or in PowerShell (Start-Service shows a long message).

8.2 Event Log Entries for Service Failures

What it is: The SCM writes a record into the System event log for important service events. The source (also called provider) is Service Control Manager. You read it with Event Viewer (a built-in tool) or PowerShell.

Open Event Viewer: press Win + R, type eventvwr.msc, press Enter. Open Windows Logs then System. Use Filter Current Log and choose the source Service Control Manager.

The event IDs worth knowing:

Reading an entry. An example in plain form:

Event ID : 7000
Source   : Service Control Manager
Text     : The <Service Name> service failed to start due to
           the following error: The service did not respond to the
           start or control request in a timely fashion.

It tells you: which service, and why (the error text matches a code from 8.1).

Read them from PowerShell (read-only):

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Service Control Manager'} -MaxEvents 20 |
  Select-Object TimeCreated, Id, LevelDisplayName, Message

Only the last 20 entries are shown. To search for just the failures, add a filter on the Id values:

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Service Control Manager'; Id=7000,7001,7009,7023,7031,7034} -MaxEvents 20 -ErrorAction SilentlyContinue

(If nothing has failed recently, it simply shows nothing.)

Look at the time. Compare the time of the event with the time you started the PC or changed something. Failures often line up with a software install or an update.

Other places to look:

8.3 Diagnosing a Service That Won't Start

What it is: A repeatable checklist. Work top to bottom, one step at a time, and write down what you find.

 Start fails
   │
   ├─1─► Read the exact error (number and text)
   ├─2─► Check the Startup Type            (Disabled? → 1058)
   ├─3─► Check the Dependencies tab        (any not running? → 1068)
   ├─4─► Check the Log On account          (password/rights? → 1069)
   ├─5─► Check the file path (ImagePath)   (file exists? → error 2)
   ├─6─► Read Event Viewer System log      (7000, 7009, 7023, 7034 ...)
   ├─7─► Read the program's own log
   └─8─► Search for the exact error text, or contact the vendor

Step by step:

1. Get the exact message. Try sc start <name> (admin) or look at the pop-up. Write down the number.
2. Startup Type. sc qc <name>: look at START_TYPE. If DISABLED, that is the whole story (and ask yourself why someone disabled it).
3. Dependencies. In sc qc, read DEPENDENCIES. For each, run sc query <dep> and see if it is RUNNING. If not, diagnose that one first (Section 4.3).
4. Account. In sc qc, read SERVICE_START_NAME. A custom user? Check the password and whether the account is locked.
5. File path. In sc qc, read BINARY_PATH_NAME. Paste that path into File Explorer (without arguments). Does the file exist? Is it blocked or deleted by antivirus?
6. Event Viewer. Find the 7000/7001/7009/7023/7034 near the failure time.
7. Program log. Many products write their own log with a precise reason.
8. Last resorts. Repair or reinstall the product. For a Windows service, run Windows Update, or sfc /scannow (a built-in system file check, run as admin).

Quick tool table:

A worked example.

Symptom : You press Start on service "ExampleSvc" and see error 1068.
Step 3  : The Dependencies tab shows it needs "ExampleHelper".
          "ExampleHelper" is Disabled.
Fix     : Set ExampleHelper back to Manual or Automatic (if that was the
          original), start it, then start ExampleSvc.
Lesson  : The error was shown for ExampleSvc; the cause was one level down.

Cautions:

• Do not delete registry keys under ...\Services to "clean up". That can remove drivers and services Windows needs.
• Do not run random "service repair" tools downloaded from the internet.
• Change one thing at a time. Then retry. That way you know what fixed it.
• If the failing service is a core Windows component and the PC behaves badly, use System Restore or ask for help rather than guessing.

Summary