Defensive tooling stopped and left stopped.
What gives it awayA security or logging service terminating with no restart, followed by other activity on the machine.
ATT&CK T1562.001Windows System Log · Event 7034
Event 7034: A service terminated unexpectedly and stayed stopped
A service crashed and Windows did nothing about it, because no recovery action was configured. That makes it more consequential than the near-identical Event 7031 — whatever the service was doing has simply stopped.
Also written as 7034Event ID 7034
- How oftenFires regularly
- Vendor calls itError
- LogSystem
- SourceService Control Manager
What it means for you
On a personal computer
A background component stopped and did not come back. If something on your PC has stopped working, this may be why — restarting usually brings it back.
For an analyst
The absence of recovery is the point. Check your service recovery configuration for anything you depend on; a security agent with no restart action is a single crash away from being offline indefinitely.
What it looks like
Sanitised. Addresses come from the RFC 5737 documentation ranges.
The SysmonDrv service terminated unexpectedly. It has done this 1 time(s).The fields that decide it
Everything else in the log line is context.
- Service name
- Which service died and has not been restarted.
- Failure count
- How many times it has terminated. Repeated entries mean a persistent fault.
Ordinary reasons this happens
Most of the time it is one of these.
- A third-party service with no recovery configured crashing on a machine that does not need it.
- A service failing during shutdown.
- A dependency that was unavailable, causing the service to exit.
- Software mid-upgrade, where the service is expected to stop.
When it is not ordinary
Log forwarding silenced.
What gives it awayAn event forwarding or SIEM agent terminating, producing a visible gap in collected data.
ATT&CK T1562.002What to do next
- Read the service name and decide whether anything depends on it.
- Check whether the service is currently running. Unlike 7031, nothing will have restarted it.
- Look for a matching crash record in the Application log at the same time.
- Configure a recovery action if this is a service you rely on.
- For security or logging services, check what else happened on the machine after it stopped.
Queries to run
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7034} -MaxEvents 50 | Select-Object TimeCreated, Message | Format-ListGet-Service | Where-Object { $_.StartType -eq 'Automatic' -and $_.Status -ne 'Running' } | Select-Object Name, DisplayName, StatusCommon questions
What is the difference between Event 7034 and Event 7031?
Both record a service terminating unexpectedly. 7031 means Windows has a recovery action configured and will do something — usually restart it. 7034 means there is no recovery action, so the service stays stopped until something or someone starts it again.
How do I make a service restart automatically after it crashes?
Open Services, find the service, and use the Recovery tab to set the first, second, and subsequent failure actions to Restart the Service. From then on the same crash produces Event 7031 with a restart rather than 7034 with nothing.
Read next
- The equivalent of Event 7031: A service terminated unexpectedly The same failure where a recovery action exists, so Windows restarts the service.
- The equivalent of Event 7000: A service failed to start A service that never started successfully in the first place.
- Read alongside Event 1000: An application crashed The crash record naming the faulting module.
- Usually comes before Event 7045: A new service was installed Service installation, useful when the failing service is new.
Mentioned by
Vendor documentation
Last reviewed 28 August 2026