Log Dejargonizer

Windows System Log · Event 7036

Event 7036: A service started or stopped

A Windows service told the system it had changed state — usually to running or stopped. It is the single most common line in the System log and it is purely informational. It is also the one event that cannot tell you whether a service stopped on purpose.

Also written as Event ID 7036entered the running stateentered the stopped stateservice state change notificationSCM 7036

What it means for you

On a personal computer

Nothing is wrong. Windows starts and stops dozens of background services all day — when you plug in a printer, when Windows Update runs, when you open the Store. If you sorted Event Viewer by count, this would be first by a wide margin. You can safely ignore every one of them.

For an analyst

Useless alone, valuable as a timeline. Because it fires for every transition of every service, it gives you a minute-by-minute record of what was running on a host during an incident window — including services that were installed, used, and deleted before you arrived. Pair it with 7045 to catch the install, and 7036 will often show you the service actually being started afterwards.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
Log Name:      System
Source:        Service Control Manager
Event ID:      7036
Level:         Information
Computer:      DESKTOP-WKS042

The Windows Modules Installer service entered the running state.

The fields that decide it

Everything else in the log line is context.

Service name
The service's display name, not its short name — the message says 'Windows Update', never 'wuauserv'. In the event XML the display name is param1 and the state text is param2. The short name is there, but only in the Binary field, hex-encoded as UTF-16LE with a '/1' suffix, which is why nobody finds it.
State
The state the service reported reaching.
  • runningThe service started and is now live.
  • stoppedThe service is no longer running. This text is identical whether it exited cleanly or crashed.
  • pausedRare outside of a handful of services that support pausing.
  • start pending / stop pendingOnly recorded on services that take long enough to transition for the SCM to notice.
Level
Always Information. If a filter is showing 7036 as Critical or Error, the filter is matching on the wrong log or the wrong provider — Service Control Manager never raises 7036 above Information.
Binary
The overlooked field. It carries the service's short name as hex-encoded UTF-16LE — 7300700070007300760063002F0031000000 decodes to 'sppsvc/1'. This matters because the display name is localised and can be changed, while the short name is the one that identifies the service in the registry. Decode it with [Text.Encoding]::Unicode.GetString([byte[]]($hex -split '(..)' -ne '' | ForEach-Object { [Convert]::ToByte($_,16) })).

Ordinary reasons this happens

Most of the time it is one of these.

  • Windows Update running: Windows Modules Installer, Background Intelligent Transfer Service and the Update Orchestrator all cycle noisily during a patch.
  • Trigger-started services doing exactly what they are supposed to — plugging in a USB device, joining Wi-Fi, or opening a Store app each start a service and stop it again minutes later.
  • Manual and delayed-start services finishing their startup sequence in the first two minutes after boot.
  • Antivirus and backup agents starting a scan helper and stopping it afterwards.
  • A service you stopped yourself from services.msc, which produces exactly the same line as one that crashed.

When it is not ordinary

A service installed for persistence being started for the first time.

What gives it awayA 7036 'entered the running state' for a display name you do not recognise, minutes after a 7045 for the same service. The 7045 is the finding; the 7036 confirms it actually ran.

ATT&CK T1543.003

Security tooling being stopped before something else happens.

What gives it awayA 7036 'entered the stopped state' for an endpoint agent, Windows Defender service, or the Windows Event Log service, with no maintenance window around it and no matching restart.

ATT&CK T1562.001

A legitimate service name being squatted on.

What gives it awayA display name that is a near-miss of a real one — extra space, swapped letter, or a Microsoft-sounding name that does not exist in a clean build of the same OS version.

ATT&CK T1036.004

What to do next

  1. Decide first whether you care about a single event or a pattern. A single 7036 answers nothing.
  2. If a service is flapping, count the transitions. Running/stopped pairs repeating on a fixed interval means the service is crashing and the SCM recovery settings are restarting it — go and read 7031 or 7034 for that service, which carry the actual failure.
  3. If you are chasing an unfamiliar service, get its short name — either decode the event's Binary field, or translate the display name with `Get-Service | Where-Object DisplayName -eq 'Name Here'` — then look at its binary path.
  4. Check for a 7045 for the same service earlier in the log. A service that appeared recently and was never installed by you is the thing to investigate.
  5. If a security service stopped, look for a 7040 (start type changed) around the same time. Disabling then stopping is a deliberate sequence; stopping alone is often a crash.

Queries to run

powershell Properties[0] is the display name and Properties[1] the state. Reading them positionally avoids parsing the rendered message, which is localised. 
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Service Control Manager'; Id=7036} -MaxEvents 200 | Select-Object TimeCreated, @{n='Service';e={$_.Properties[0].Value}}, @{n='State';e={$_.Properties[1].Value}}
powershell Which services are responsible for the volume. A flapping service jumps straight to the top. 
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036} | Group-Object {$_.Properties[0].Value} | Sort-Object Count -Descending | Select-Object -First 15
kql Narrow to security services stopping, which is the only high-value slice of an otherwise very-high-noise event. 
Event | where Source == 'Service Control Manager' and EventID == 7036 | where RenderedDescription has 'stopped' | where RenderedDescription has_any ('Defender','Sense','Sophos','CrowdStrike') | project TimeGenerated, Computer, RenderedDescription
wevtutil Last twenty state changes on a machine with no central logging. 
wevtutil qe System "/q:*[System[Provider[@Name='Service Control Manager'] and (EventID=7036)]]" /c:20 /rd:true /f:text

Common questions

Why is my System log full of Event 7036?

Because Windows starts and stops services constantly and logs every transition. Hundreds a day on a desktop and thousands on a busy server is normal. There is no setting to reduce it and no reason to — the volume is the event working as designed. If it is drowning out what you are looking for, filter Event Viewer to exclude 7036 rather than trying to stop it.

Does Event 7036 mean a service crashed?

No, and this is the event's main weakness. 'Entered the stopped state' reads exactly the same whether you stopped the service by hand, Windows stopped it because nothing needed it any more, or it crashed. To find out which, look for Event 7031 or 7034 for the same service at the same time — those are only written when the stop was unexpected.

How do I find which service Event 7036 is talking about?

The message only shows the friendly display name, such as 'Windows Modules Installer'. The short name is in the event's Binary data, hex-encoded as UTF-16LE — decode it and you get something like 'TrustedInstaller/1'. If you would rather not, run `Get-Service | Where-Object DisplayName -eq 'Windows Modules Installer' | Select-Object Name` and then read the ImagePath under HKLM\SYSTEM\CurrentControlSet\Services\<Name>.

Is Event 7036 ever a security concern?

Indirectly. On its own it is informational, but it is one of the few places a defender can see that a service actually ran. Two patterns matter: an unfamiliar service entering the running state shortly after an Event 7045 installed it, and a security or logging service entering the stopped state outside a maintenance window.

Read next

Mentioned by

Vendor documentation

Last reviewed 7 September 2026