A security service prevented from responding.
What gives it awayRepeated timeouts for antivirus or EDR specifically, while other services respond normally.
ATT&CK T1562.001Windows System Log · Event 7011
Event 7011: A service stopped responding to Windows
Windows asked a service to do something and got no reply within the timeout. On a machine that is slow to start or shut down, this is usually the reason — and it is far more often a symptom of overloaded storage than of a broken service.
Also written as Event ID 70117011 service timeout
- How oftenFires regularly
- Vendor calls itError
- LogSystem
- SourceService Control Manager
What it means for you
On a personal computer
A background component took too long to answer. This is usually why a PC seems to hang during startup or shutdown, especially on an older mechanical hard drive.
For an analyst
Extremely common on virtual machines with contended storage and on machines with many services starting at once. Look for one service name recurring — a consistent offender is a real problem, whereas a scattering of different names across shutdowns is a storage or resource problem.
What it looks like
Sanitised. Addresses come from the RFC 5737 documentation ranges.
A timeout (30000 milliseconds) was reached while waiting for a transaction response from the AppReadiness service.The fields that decide it
Everything else in the log line is context.
- Service name
- Which service failed to respond. A recurring name is the useful signal.
- Timeout value
- How long Windows waited, in milliseconds. Usually 30000, and configurable globally.
- Timing
- Not a field, but whether this happens at startup, at shutdown, or during normal operation narrows the cause considerably.
Ordinary reasons this happens
Most of the time it is one of these.
- A slow boot or shutdown on a machine with a mechanical drive.
- Many services competing for input and output at once.
- A virtual machine contending for host resources.
- Antivirus scanning during startup, delaying everything.
- A service waiting on a network resource that is not available yet.
When it is not ordinary
Resource exhaustion caused by unwanted software.
What gives it awayWidespread timeouts on a machine with sustained high CPU or disk load from an unfamiliar process.
ATT&CK T1496What to do next
- Note whether the same service name recurs. One consistent offender is a real fault; a scattering is a resource problem.
- Note when it happens — startup, shutdown, or during use.
- Check disk performance. Storage that cannot keep up is the most common cause by a distance.
- On a virtual machine, check host storage latency before investigating the guest.
- For a consistently slow service, set it to delayed start so it is not competing at boot.
- Raise ServicesPipeTimeout only as a last resort — it applies to every service and makes real failures slower to surface.
Queries to run
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7011} -MaxEvents 50 | Select-Object TimeCreated, Message | Format-ListEvent | where EventLog == 'System' and EventID == 7011 | extend Svc = extract(@'from the (.+?) service', 1, RenderedDescription) | summarize count() by Svc, Computer | order by count_ descCommon questions
Why does my computer hang on shutdown with Event 7011?
Because a service is not responding to the stop request and Windows waits the full timeout before giving up. Each one that hangs adds its own delay. Find the service names in these events — a consistent offender can usually be set to delayed start or updated. On older machines, a slow mechanical drive is often the underlying reason.
Is Event 7011 a hardware problem?
Often, indirectly. It means something did not answer in time, and the most common reason is storage that cannot keep up rather than a broken service. Look for Events 129 and 51 around the same time — if they are present, the disk is the problem and the service timeouts are a symptom.
Read next
- Read alongside Event 7009: A service timed out while starting A start timeout, which describes the same kind of problem at boot.
- Usually comes after Event 7000: A service failed to start The service failing to start after timing out.
- Usually comes before Event 129: A storage controller reset the drive Storage controller resets, which cause exactly this kind of timeout.
- Usually comes before Event 51: A paging error on a disk Disk paging errors, another sign the storage cannot keep up.
- Usually comes after Event 6008: The previous system shutdown was unexpected An unexpected shutdown, when a shutdown hang is eventually forced.
Mentioned by
Vendor documentation
Last reviewed 28 August 2026