Windows Event ID 7036 – Service Control Manager: Service State Change Notification

Start by examining recent 7036 events to identify patterns or problematic services:

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. In the Actions pane, click Filter Current Log
4. Enter 7036 in the Event IDs field and click OK
5. Review the recent events, noting service names and timestamps
6. Look for services that frequently start and stop, which may indicate instability
7. Right-click any event and select Event Properties to view detailed information

Focus on services that show unusual patterns, such as multiple restarts within short timeframes or critical system services that have stopped unexpectedly.

Use PowerShell to perform advanced filtering and analysis of service state changes:

# Get last 50 service state change events
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036} -MaxEvents 50

# Filter for specific service events
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036} | Where-Object {$_.Message -like "*Windows Update*"}

# Find services that stopped in the last 24 hours
$Yesterday = (Get-Date).AddDays(-1)
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036; StartTime=$Yesterday} | Where-Object {$_.Message -like "*stopped*"}

# Export service events to CSV for analysis
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036} -MaxEvents 1000 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Export-Csv -Path "C:\Temp\ServiceEvents.csv" -NoTypeInformation

These commands help identify specific services experiencing issues and provide data for trend analysis.

When services frequently restart, examine their configuration and dependencies:

1. Open Services console by running services.msc
2. Locate the service showing frequent state changes in Event ID 7036 logs
3. Right-click the service and select Properties
4. Check the Recovery tab for automatic restart settings
5. Review the Dependencies tab to understand service relationships
6. Use PowerShell to get detailed service information:

# Get service details including dependencies
Get-Service -Name "ServiceName" | Format-List *

# Check service recovery settings via registry
$ServiceName = "YourServiceName"
$RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$ServiceName"
Get-ItemProperty -Path $RegPath -Name "FailureActions" -ErrorAction SilentlyContinue

# List all services and their current states
Get-Service | Sort-Object Status, Name | Format-Table Name, Status, StartType

Pay attention to services configured for automatic restart, as these generate predictable 7036 events during recovery operations.

Correlate service state changes with system performance to identify resource-related issues:

1. Open Performance Monitor by running perfmon.msc
2. Add counters for Process → % Processor Time and Working Set
3. Monitor services that frequently appear in 7036 events
4. Use PowerShell to check service resource usage:

# Get process information for running services
Get-WmiObject Win32_Service | Where-Object {$_.State -eq "Running"} | ForEach-Object {
    $ProcessId = $_.ProcessId
    if ($ProcessId -gt 0) {
        $Process = Get-Process -Id $ProcessId -ErrorAction SilentlyContinue
        if ($Process) {
            [PSCustomObject]@{
                ServiceName = $_.Name
                ProcessName = $Process.ProcessName
                CPU = $Process.CPU
                WorkingSet = [math]::Round($Process.WorkingSet64/1MB, 2)
            }
        }
    }
} | Sort-Object CPU -Descending

# Monitor service start times and correlate with system events
Get-EventLog -LogName System -InstanceId 7036 -After (Get-Date).AddHours(-1) | Select-Object TimeGenerated, Message

This helps identify services consuming excessive resources that might be causing instability.

Set up proactive monitoring to track service state changes and identify issues before they impact users:

# Create a PowerShell script for continuous service monitoring
$LogPath = "C:\Logs\ServiceMonitoring.log"
$CriticalServices = @("Spooler", "BITS", "Themes", "AudioSrv")

# Function to log service events
function Write-ServiceLog {
    param($Message)
    $Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    "$Timestamp - $Message" | Out-File -FilePath $LogPath -Append
}

# Monitor for service state changes
Register-WmiEvent -Query "SELECT * FROM Win32_VolumeChangeEvent WHERE EventType = 2" -Action {
    $Event = $Event.SourceEventArgs.NewEvent
    Write-ServiceLog "Service state change detected: $($Event.TargetInstance.Name)"
}

# Check critical services every 5 minutes
while ($true) {
    foreach ($Service in $CriticalServices) {
        $ServiceStatus = Get-Service -Name $Service -ErrorAction SilentlyContinue
        if ($ServiceStatus.Status -ne "Running") {
            Write-ServiceLog "ALERT: Critical service $Service is $($ServiceStatus.Status)"
            # Add email notification or other alerting mechanism here
        }
    }
    Start-Sleep -Seconds 300
}

Configure Windows Task Scheduler to run this monitoring script at startup for continuous service oversight.