The Core Technologies Blog

Professional Software for Windows Services / 24×7 Operation


When did my Windows Service Start?

Windows Service Uptime

Here are four ways to determine when your windows service last started.

Solution #1: Search the Windows Event Logs with PowerShell

The Windows Event Logs hold a wealth of information about your computer’s activities. Indeed, a new record is added to the System event log whenever a windows service starts or stops.

The easiest way to find your service’s most recent start time is to use a specially crafted PowerShell command to search the System event log. For example, the following line will return the last time the “Print Spooler” service was started:

(Get-EventLog -LogName "System" -Source "Service Control Manager" -EntryType "Information" -Message "*Print Spooler service*running*" -Newest 1).TimeGenerated

Be sure to replace "Print Spooler" with the display name of the service you are investigating!


PowerShell - Windows Service Start Time

Solution #2: Search the Windows Event Logs using the Event Viewer

Instead of running a PowerShell command, you can also search the Event Log manually.

To find the event log record showing when your service was last started:

  1. Open the Event Viewer from the Control Panel (search for it by name).

  2. In the left-hand column, navigate to Windows Logs > System:


    Event Viewer - Open System Log

  3. Click Find… on the right to bring up the Find window. Enter the name of the service and click the Find Next button to highlight the first matching record in the middle panel. We have entered Spooler, for the Windows Spooler service:


    Event Viewer - Find

  4. If necessary, keep clicking the Find Next button until a record saying that your service has “entered the running state” comes up. The Source should be Service Control Manager, and the time your service started will be displayed in the Logged value. The screenshot show that the Print Spooler service last started at 8:04:55 AM on January 7th 2017:


    Print Spooler service start time

Solution #3: Figure out when the Service’s Process was Started

Each running windows service is backed by an underlying process. 99.9% of the time, that process was launched immediately when the service started. So finding the process start time will give us the service start time.

To find out when the service’s process was started:

  1. Determine the process identifier (PID) of the service’s process using the SC command. For a service named MyService, run:

    sc queryex MyService

    (Be sure to enclose the service name in quotes if it contains spaces.)

    Here is the result for the Spooler service:


    Use SC to find the Service PID

    Make a note of the number on the PID line (1276 in the screenshot above).

  2. Next, open a PowerShell window and run:

    Get-Process | select name, id, starttime | select-string <PID>

    where <PID> is the process identifier from step 1. The start time will come back in the result. Here is what we got for the spooler’s process (#1276):


    Run PowerShell Get-Process

Solution #4: Use the System Boot/Up Time (for Automatic Windows Services)

Most Windows Services start when your computer boots and run continuously, 24×7 in the background. For those services, the system boot time is a reasonable approximate.

You can run the built-in systeminfo command to discover when the system last started. Amongst the valuable information systeminfo returns, look for the “System Boot Time” line:


System Boot Time

However, if you’re ever in a situation where you can’t remember the command to use, know that the Task Manager’s Performance tab shows how long the computer has been up (“Up time”). The system boot time is a simple calculation away.


Task Manager - Uptime

So there are four easy ways to find out when your windows service started. Use whichever one best fits your situation. Good luck with your troubleshooting/investigation!

Posted in Windows Services | Tagged , , , , | 11 Comments

11 Responses to When did my Windows Service Start?

  1. idalberto says:

    Worked fine on windows 7 machines but not in windows 10. I also had issues when tried to filter the source “”Service Control Manager’.. also, when to event viewer, reset spooler couldn’t find the service log.. any idea why? It’s also happening on more than one machine on win10..

  2. Core Technologies Consulting says:

    Hi idalberto. Are you an administrator on the machine? Please send the details (to support@CoreTechnologies.com), including the following:

    1. The name of the service you are investigating
    2. The output of the Powershell command
    3. Screenshots of the Event Viewer showing the problem

    We’ll help you get to the bottom of it soon!

    • Idalberto says:

      The service is the spooler. I’ll send more details to the support email. Notice on Windows 10 in the Event Viewer there is stop/start event of any service.

  3. Amrita says:

    Very useful Post. We saved one client escalation with the help of this post.

  4. know-net says:

    I have created a windows service with Automatic Start Type and install it in my system successfully but it does not start until i restart my system. Details: yesterday i have create and install my service and then restart my windows so the service started successfully. but the problem occurred today when i boot my windows and opened the services list of windows from Control Panel\Administrative Tools\Services and selected my service i saw that it did not start automatically. what is my mistake?

  5. Hi.

    Sometimes services start too early, before the systems they need are not fully initialized.

    Please try setting your service to start “Automatic (Delayed Start)” and see if that helps.

  6. Dav says:

    Hi

    Thank you for this command, that is great, I need to know when this service was disabled or stopped? Are you able to provide the power shell command for it please?

  7. Hi Dev.

    Unfortunately we don’t know of any Powershell command that reveals when a service was disabled or stopped.

  8. Mehrnaz Zadeh says:

    i did the same thing as Solution #3 , but in result I got StartTime =}
    why i didn’t have any time in result?

  9. Mehrnaz Zadeh says:

    I had to open pwershell as Adminstrator. 🙂

  10. Andrew Phillips says:

    services.msc should have a “Started” column, for the time the services was last started, or even show the time in the Status column instead of just “Running”

Leave a Reply

Your email address will not be published. Required fields are marked *