Log Dejargonizer

Windows System Log · Event 7038

Event 7038: A service could not log on with its stored password

A service is configured to run as a specific user account, and Windows refused that sign-in. Unlike most service failures this one names the account, not just the service — which is the fastest route to the cause, because it is nearly always a password that changed somewhere else.

Also written as Event ID 7038service was unable to log on7038 logon failure serviceSCM 7038

What it means for you

On a personal computer

You will rarely see this on a personal PC, because almost everything runs as LocalSystem or a built-in account with no password. If you do see it, something you installed — a backup tool, a database, a media server — was set up to run as your Windows user, and your password has since changed.

For an analyst

Read the account name and the failure reason together. A password mismatch and a missing SeServiceLogonRight look identical from the service's point of view but have completely different fixes. On a domain controller, correlate with Security 4625 LogonType 5 from the same host, and check whether the repeated attempts are driving 4740 lockouts on the service account.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
Log Name:      System
Source:        Service Control Manager
Event ID:      7038
Level:         Error
Computer:      APP-SRV-02

The BackupAgentSvc service was unable to log on as CORP\svc_backup with the currently configured password due to the following error:
Logon failure: unknown user name or bad password.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

The fields that decide it

Everything else in the log line is context.

Service name
Which service failed to start. Named by its short service name here, unlike Event 7036.
Account
The account the service was configured to run as. This is the field that makes 7038 worth more than the generic start failures.
  • DOMAIN\svc_accountA domain service account. Suspect a password rotation or an expired password.
  • .\localuserA local account. Suspect a local password change or the account being deleted.
  • DOMAIN\machine$A group managed service account. These rotate their own passwords, so a failure here points at the host's ability to retrieve the password, not the password itself.
Error text
The Win32 reason the logon was refused.
  • The user name or password is incorrectThe stored password is stale. Almost always a password rotation that did not reach the service.
  • The user has not been granted the requested logon type at this computerThe account lost the 'Log on as a service' right — usually because a Group Policy that defines that right refreshed and did not include it.
  • The referenced account is currently locked outRepeated retries by this or another service already locked the account. Fix the password before unlocking or it will lock again.
  • The specified account does not existThe account was deleted or renamed. Common after an offboarding.

Ordinary reasons this happens

Most of the time it is one of these.

  • A scheduled password rotation on a service account where the service's stored copy was not updated at the same time.
  • An administrator changing their own domain password on an account that a service was set up to run as years ago.
  • A Group Policy refresh replacing the local 'Log on as a service' user right assignment, dropping the account that used to be listed.
  • An account deleted or renamed during offboarding without anyone checking what it was still running.
  • A server restored from a backup or an image with an old copy of the service's stored credential.

When it is not ordinary

A service account credential being reused elsewhere, tripping a lockout that then breaks the legitimate service.

What gives it awayThe 7038 says 'locked out' rather than 'incorrect password', and the Security log shows 4625 or 4771 failures for that account from a host that is not the one running the service.

ATT&CK T1078.002

Defensive tooling neutered by revoking its service account's rights rather than by stopping it.

What gives it awayThe error text is the logon-type one, the affected service is a security agent, and a Group Policy or local security policy change (Event 4719 or a GPO edit) precedes it.

ATT&CK T1562.001

What to do next

  1. Read the account name and the error text together — they determine which of two completely different fixes you need.
  2. If the text is about the user name or password, reset the stored credential on the service's Log On tab, or with `sc.exe config <service> obj= <account> password= <value>`. Changing the account's password in Active Directory does not update the service.
  3. If the text is about the requested logon type, add the account back to 'Log on as a service' in secpol.msc under Local Policies > User Rights Assignment. If a Group Policy defines that setting, edit the GPO instead — a local change will be overwritten at the next refresh.
  4. Check whether the account is also configured on scheduled tasks or other services on other machines. One stale copy is common; three is usual.
  5. On a domain, check Security 4740 for that account before unlocking it. Unlocking without fixing every stale copy of the password just restarts the lockout cycle.
  6. Once fixed, confirm with a 7036 'entered the running state' for the same service rather than assuming the start worked.

Queries to run

powershell The rendered message carries both the service and the account, so reading it in full is faster than picking properties out. 
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7038} -MaxEvents 50 | Select-Object TimeCreated, Message | Format-List
powershell Every service on the host running under a named account. Run this before a password rotation, not after. 
Get-CimInstance Win32_Service | Where-Object { $_.StartName -notmatch '^(LocalSystem|NT AUTHORITY|NT SERVICE)' } | Select-Object Name, StartName, State
kql Groups by service account so a single rotated password that broke ten servers shows up as one row per host. 
Event | where EventID == 7038 | extend Account = extract(@'account: ([^\s\.]+)', 1, RenderedDescription) | summarize Failures = count() by Computer, Account | order by Failures desc

Common questions

Why does Event 7038 keep coming back after I reset the password?

Because resetting the password in Active Directory does not update the copy stored on the machine. Windows keeps the service's password in the local LSA secrets, separately from the account itself. You have to set it again on the service — Services snap-in, Log On tab, or `sc.exe config` — on every machine where that account runs a service or a scheduled task.

What is the difference between Event 7038 and Event 7000?

7000 says the service did not start and gives a generic reason. 7038 says specifically that the account the service runs as could not sign in, and it names that account. They usually appear together: 7038 is the cause and 7000 is the consequence. Fix what 7038 tells you and 7000 goes away.

What does 'the user has not been granted the requested logon type at this computer' mean?

Running as a service is a separate privilege from logging on interactively, controlled by the 'Log on as a service' user right. If the account is not listed there, Windows refuses the sign-in even though the password is correct. This most often appears the day after someone edits a Group Policy that defines that user right, because the policy replaces the local list rather than adding to it.

Read next

Vendor documentation

Last reviewed 7 September 2026