Security tooling being disabled.
What gives it awayA 7031 for an antivirus, EDR, or log forwarding service, particularly one that does not recur and coincides with other unusual activity.
ATT&CK T1562.001Windows System Log · Event 7031
Event 7031: A service terminated unexpectedly
A Windows service crashed rather than stopping cleanly, and Windows is recording what it plans to do about it. The service name is the whole event — everything useful comes from working out why that particular service died.
Also written as 7031Event ID 7031service terminated unexpectedlyService Control Manager 7031
- How oftenFires regularly
- Vendor calls itError
- LogSystem
- SourceService Control Manager
What it means for you
On a personal computer
A background Windows component stopped working and Windows restarted it. Usually harmless and self-correcting. Worth attention if it happens repeatedly or if the name mentions your antivirus.
For an analyst
Watch this specifically for security agents, logging agents, and EDR services. Attackers crash or stop defensive services deliberately, and a 7031 for your endpoint agent should be treated as a potential tamper event until proven to be a bug. The restart count in the message tells you whether this is the first failure or a repeating one.
What it looks like
Sanitised. Addresses come from the RFC 5737 documentation ranges.
The Print Spooler service terminated unexpectedly. It has done this 3 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.The fields that decide it
Everything else in the log line is context.
- Service name
- Which service died. A security or logging service here changes the priority completely.
- Failure count
- How many times it has terminated unexpectedly. A rising count means a persistent fault rather than a one-off.
- Recovery action
- What Windows will do — restart the service, run a program, or nothing. Configured per service in its recovery settings.
Ordinary reasons this happens
Most of the time it is one of these.
- A buggy third-party service that crashes periodically and restarts without consequence.
- A service failing during shutdown, which is common and usually harmless.
- A service whose dependency was not ready yet at boot.
- Resource exhaustion on a heavily loaded machine.
- A software update replacing files underneath a running service.
When it is not ordinary
Log collection being interrupted before something happens.
What gives it awayThe Windows Event Log service or a forwarding agent terminating, followed by a gap in collected events.
ATT&CK T1562.002A service crashed to trigger a recovery action that runs an attacker-supplied program.
What gives it awayA 7031 for a service whose configured recovery action runs an unexpected binary.
ATT&CK T1543.003What to do next
- Read the service name first — a security or logging service is a different investigation from a printer spooler.
- Check the Application log at the same timestamp for a matching crash record naming the faulting module.
- Look at the failure count. Once is a glitch; a rising count is a fault that needs fixing.
- Check whether the service came back. A service that stayed stopped is more serious than one that restarted.
- For security services, confirm nothing else on the machine looks unusual around the same time.
- Check whether a software update or installation was running when it happened.
Queries to run
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7031,7034} -MaxEvents 50 | Select-Object TimeCreated, Id, Message | Format-ListEvent | where EventLog == 'System' and EventID in (7031, 7034) | extend Service = extract(@'The (.+?) service terminated', 1, RenderedDescription) | summarize count() by Computer, Service | order by count_ descindex=wineventlog EventCode IN (7031,7034) | rex "The (?<service>.+?) service terminated" | stats count by service dest | sort -countCommon questions
Should I worry about Event 7031?
It depends entirely on which service. A print spooler or an update service crashing occasionally is ordinary and self-correcting. Your antivirus, EDR agent, or the Windows Event Log service terminating is worth investigating properly, because those failures leave the machine less protected or less observable.
How do I stop a service from repeatedly terminating?
Find out why it is crashing rather than just restarting it. Check the Application log at the same timestamp for a crash record naming the faulting module, then update or reinstall whatever that points at. Adjusting the service's recovery settings to restart it faster hides the problem without solving it.
What is the difference between Event 7031 and Event 7034?
Both mean a service terminated unexpectedly. 7031 is written when the service has a configured recovery action, and the message tells you what Windows will do next. 7034 is written when there is no recovery action, so Windows just records the failure and leaves the service stopped.
Read next
- The equivalent of Event 7034: A service terminated unexpectedly and stayed stopped The same failure where no recovery action is configured, so Windows simply reports it.
- The equivalent of Event 7000: A service failed to start A service that failed to start at all, rather than one that started and later died.
- Read alongside Event 7009: A service timed out while starting A service that timed out while starting, a common precursor to repeated failures.
- Read alongside Event 1000: An application crashed The application-level crash record, which names the faulting module.
- Usually comes before Event 7045: A new service was installed Service installation. A brand-new service crashing immediately is worth a closer look.
- The equivalent of Event 7023: A service stopped with an error A service stopping with a reported reason rather than crashing.
- Read alongside Event 7011: A service stopped responding to Windows A service failing to respond in time, which often precedes it.
Mentioned by
Vendor documentation
Last reviewed 28 August 2026