Windows System Log · Event 7009
Event 7009: A service timed out while starting
A service took longer than Windows was prepared to wait — 30 seconds by default — and the start was abandoned. On slow or heavily loaded machines this is usually a symptom of the boot itself being slow rather than of anything being wrong with the service.
Also written as 7009Event ID 7009
- How oftenFires regularly
- Vendor calls itError
- LogSystem
- SourceService Control Manager
What it means for you
On a personal computer
Something took too long to start when your PC booted. If everything works, you can ignore it. If a program is not working, this may be why.
For an analyst
Frequent on virtual machines with contended storage and on machines with many services starting at once. Setting services to delayed start spreads the load and resolves most of these without touching the global timeout.
What it looks like
Sanitised. Addresses come from the RFC 5737 documentation ranges.
A timeout was reached (30000 milliseconds) while waiting for the SysmonDrv service to connect.The fields that decide it
Everything else in the log line is context.
- Service name
- Which service timed out.
- Timeout value
- How long Windows waited, in milliseconds. The default is 30000 and it is configurable globally through the registry.
Ordinary reasons this happens
Most of the time it is one of these.
- A slow boot on a machine with a mechanical drive or contended storage.
- Many services starting simultaneously and competing for input and output.
- A service waiting on a network resource that is not available yet.
- Antivirus scanning during startup, delaying everything else.
- A virtual machine competing for host resources at boot.
What to do next
- Check whether the service eventually started. If it did, and everything works, this is cosmetic.
- Look for a following Event 7000 — a timeout that turns into a failure to start is the case that matters.
- Set the service to Automatic (Delayed Start) so it is not competing during the initial boot rush.
- Check whether boot storage is the bottleneck before raising the global service timeout.
- Raise the ServicesPipeTimeout registry value only as a last resort — it slows every failed start on the machine.
Queries to run
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7009,7000,7011} -MaxEvents 50 | Select-Object TimeCreated, Id, Message | Format-ListCommon questions
How do I increase the Windows service startup timeout?
Set the ServicesPipeTimeout DWORD value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control to the number of milliseconds you want, then reboot. Do this only after ruling out slow storage, because it applies to every service on the machine and makes genuine failures take longer to surface.
Is Event 7009 a problem if the service starts anyway?
Generally no. It records that the first attempt exceeded the timeout, not that the service failed permanently — Windows often starts it successfully a moment later. It matters when it is followed by Event 7000, or when something that depends on that service is not working.
Read next
- Usually comes after Event 7000: A service failed to start The service failing to start, which a timeout often leads to.
- The equivalent of Event 7031: A service terminated unexpectedly A service that started and later crashed.
- Usually comes before Event 129: A storage controller reset the drive Storage resets, which slow boots enough to cause timeouts.
- Read alongside Event 6005: The event log service started The boot this timeout occurred during.
- Read alongside Event 7011: A service stopped responding to Windows A transaction timeout, which describes the same problem during normal operation.
Mentioned by
Vendor documentation
Last reviewed 28 August 2026