A security service prevented from starting.
What gives it awayA 7000 for antivirus or EDR at every boot, particularly with an access-denied or missing-file error.
ATT&CK T1562.001Windows System Log · Event 7000
Event 7000: A service failed to start
Windows tried to start a service and it would not start. The error text at the end of the message is the actual answer — the event number tells you nothing that the error does not tell you better.
Also written as 7000Event ID 7000
- How oftenFires regularly
- Vendor calls itError
- LogSystem
- SourceService Control Manager
What it means for you
On a personal computer
Something that should have started when Windows booted did not. If a program is not working properly, this may be why. The message usually says what went wrong.
For an analyst
Frequent after uninstalls that leave service registrations behind, and after driver signing enforcement blocks a kernel service. A security agent failing to start at boot deserves the same scrutiny as one that crashed.
What it looks like
Sanitised. Addresses come from the RFC 5737 documentation ranges.
The SysmonDrv service failed to start due to the following error:
The system cannot find the file specified.The fields that decide it
Everything else in the log line is context.
- Service name
- Which service failed to start.
- Error
- The reason it failed. This is the field that matters.
-
The system cannot find the file specifiedThe service is registered but its executable is gone — usually a partial uninstall. -
Access is deniedA permissions problem on the binary or the service account. -
The service did not respond to the start or control request in a timely fashionA timeout, which is often just a slow boot rather than a real fault. -
A device attached to the system is not functioningTypically a driver service whose hardware is absent or faulty. -
The specified service has been marked for deletionAn uninstall is incomplete and needs a reboot to finish.
Ordinary reasons this happens
Most of the time it is one of these.
- A partial or interrupted uninstall leaving a service registration with no executable.
- A driver service for hardware that is no longer present in the machine.
- A service whose dependency had not started yet, common on slow boots.
- A service disabled deliberately but still attempted by a leftover configuration.
- A pending reboot after a software update.
When it is not ordinary
A service pointed at a binary that has been removed or replaced.
What gives it awayA missing-file error for a service that used to work, with no matching uninstall.
ATT&CK T1543.003What to do next
- Read the error text. It is more useful than the event ID.
- Check whether the service's executable still exists at the registered path.
- For timeouts, check whether the machine is simply slow to boot before assuming a fault.
- For driver services, check whether the hardware is still installed.
- If the service is not needed, remove its registration rather than leaving it failing at every boot.
- For security services, treat a persistent failure as a gap in coverage and fix it as a priority.
Queries to run
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7000,7009,7011} -MaxEvents 50 | Select-Object TimeCreated, Id, Message | Format-Listindex=wineventlog EventCode=7000 | rex "The (?<service>.+?) service failed to start" | stats count by service dest | sort -countCommon questions
How do I fix a service that fails to start with 'The system cannot find the file specified'?
The service registration survived but its program did not, which almost always means an uninstall did not finish. Either reinstall the software so the file comes back, or remove the leftover registration with `sc delete <servicename>` from an elevated command prompt. Check the registered path first so you know which you are dealing with.
Why does a service fail to start at boot but work fine when I start it manually?
Because at boot it is racing something it depends on — a network connection, another service, or a disk that is not ready yet. Setting the service to Automatic (Delayed Start), or declaring the dependency properly, usually resolves it.
What does 'The specified service has been marked for deletion' mean?
An uninstall removed the service but something still had a handle open, so Windows deferred the removal until the next reboot. Restart the machine and the message goes away; if it persists after a reboot, something is re-registering the service.
Read next
- Read alongside Event 7009: A service timed out while starting The timeout that often accompanies a slow-starting service.
- The equivalent of Event 7031: A service terminated unexpectedly A service that started successfully but later crashed.
- Usually comes before Event 7045: A new service was installed Service installation. A newly installed service failing to start is usually a bad installation.
- Read alongside Event 219: A driver failed to load for a device A driver failing to load, which frequently causes the corresponding driver service to fail.
- Related Event 7023: A service stopped with an error A service that stopped and reported why.
- Read alongside Event 1014: A DNS lookup timed out DNS lookups timing out, which is a common reason a service cannot reach what it needs at boot.
Mentioned by
Vendor documentation
Last reviewed 28 August 2026