Log Dejargonizer

Windows System Log · Event 7023

Event 7023: A service stopped with an error

A service shut down and reported a reason. Unlike a plain crash, this one tells you what went wrong in its own words — and that error text is more useful than the event number.

Also written as Event ID 70237023 service error

What it means for you

On a personal computer

A background component stopped and said why. Often it is a service that had nothing to do, which is normal.

For an analyst

Do not treat every 7023 as a fault. Several Windows services stop deliberately when idle and report a benign status. Read the error text — 'The operation completed successfully' and similar are not problems, whatever the Error severity label implies.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
The Windows Search service terminated with the following error: 
The operation completed successfully.

The fields that decide it

Everything else in the log line is context.

Service name
Which service stopped.
Error
The reason it gave. This is the field that matters.
  • The operation completed successfullyNot a failure at all. The service stopped deliberately, usually because it had nothing to do.
  • The system cannot find the file specifiedA dependency or binary is missing, usually after a partial uninstall.
  • Access is deniedA permissions problem on the service account or its files.
  • The service did not respond in a timely fashionA timeout rather than a crash.
  • A device attached to the system is not functioningTypically a driver service whose hardware is absent.

Ordinary reasons this happens

Most of the time it is one of these.

  • Services that stop when idle and report success, which is a large share of these.
  • Optional Windows features that are not configured on this machine.
  • Services stopping during shutdown.
  • A dependency stopping first and taking this one with it.
  • Hardware-dependent services on machines without that hardware.

When it is not ordinary

A security service stopped deliberately.

What gives it awayA 7023 for antivirus, EDR, or log forwarding with an access-denied error, particularly alongside other unusual activity.

ATT&CK T1562.001

A service binary removed or replaced.

What gives it awayA missing-file error for a service that previously worked, with no matching uninstall.

ATT&CK T1543.003

What to do next

  1. Read the error text before the event ID. It usually answers the question outright.
  2. If the error is 'The operation completed successfully', stop — this is not a fault.
  3. Check whether the service is one you actually depend on.
  4. For missing files, confirm whether the software was uninstalled.
  5. For security services, treat it as a coverage gap and restore it as a priority.

Queries to run

powershell The service failure events together, which usually describe one underlying problem. 
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7023,7024,7031,7034} -MaxEvents 60 | Select-Object TimeCreated, Id, Message | Format-List
kql Drops the benign idle-stop entries, which are most of the volume. 
Event | where EventLog == 'System' and EventID == 7023 | where RenderedDescription !contains 'operation completed successfully' | project TimeGenerated, Computer, RenderedDescription

Common questions

Why does Event 7023 say the operation completed successfully?

Because the service stopped on purpose and reported a success status while doing it. Windows still logs the stop at Error severity, which is misleading. If nothing is broken, this variant needs no action at all — it is one of the most commonly misread entries in the System log.

What is the difference between Event 7023 and 7031?

7023 means the service stopped and reported a reason. 7031 means it terminated unexpectedly — it crashed rather than shutting down. 7031 is the more serious of the two, because nothing chose to stop it.

Read next

Mentioned by

Vendor documentation

Last reviewed 28 August 2026