{"id":2781,"date":"2017-01-09T09:00:30","date_gmt":"2017-01-09T17:00:30","guid":{"rendered":"https:\/\/www.coretechnologies.com\/blog\/?p=2781"},"modified":"2025-12-27T00:29:25","modified_gmt":"2025-12-27T08:29:25","slug":"service-start-time","status":"publish","type":"post","link":"https:\/\/www.coretechnologies.com\/blog\/windows-services\/service-start-time\/","title":{"rendered":"When did my Windows Service Start?"},"content":{"rendered":"
\"Windows<\/div>\n

<\/p>\n

Here are four ways to determine when your windows service last started.<\/p>\n

\n
\n
\"\"<\/a><\/div>\n<\/div>\n

Solution #1: Search the Windows Event Logs with PowerShell<\/h2>\n

The Windows Event Logs<\/a> hold a wealth of information about your computer’s activities. Indeed, a new record is added to the System event log whenever a windows service starts or stops.<\/p>\n

The easiest way to find your service’s most recent start time is to use a specially crafted PowerShell command to search the System event log. For example, the following line will return the last time the “Print Spooler” service was started:<\/p>\n

(Get-EventLog -LogName "System" -Source "Service Control Manager" -EntryType "Information" -Message "*Print Spooler service*running*" -Newest 1).TimeGenerated<\/b><\/p><\/blockquote>\n

Be sure to replace "Print Spooler" with the display name of the service you are investigating!\n<\/p>\n

\n
\n\"PowerShell<\/a>\n<\/p>\n

\n
\n
\"\"<\/a><\/div>\n<\/div>\n

Solution #2: Search the Windows Event Logs using the Event Viewer<\/h2>\n

Instead of running a PowerShell command, you can also search the Event Log manually.<\/p>\n

To find the event log record showing when your service was last started:<\/p>\n

    \n
  1. \n

    Open the Event Viewer<\/b> from the Control Panel (search for it by name).<\/p>\n<\/li>\n

  2. \n

    In the left-hand column, navigate to Windows Logs > System<\/b>:<\/p>\n

    \n
    \n\"Event<\/a>\n<\/p>\n<\/li>\n

  3. \n

    Click Find…<\/b> on the right to bring up the Find window. Enter the name of the service and click the Find Next<\/b> button to highlight the first matching record in the middle panel. We have entered Spooler, for the Windows Spooler service:<\/p>\n

    \n
    \n\"Event<\/a>\n<\/p>\n<\/li>\n

  4. \n

    If necessary, keep clicking the Find Next<\/b> button until a record saying that your service has “entered the running state” comes up. The Source should be Service Control Manager<\/b>, and the time your service started will be displayed in the Logged<\/b> value. The screenshot show that the Print Spooler service last started at 8:04:55 AM on January 7th 2017:<\/p>\n

    \n
    \n\"Print<\/a>\n<\/p>\n<\/li>\n<\/ol>\n

    \n
    \n
    \"\"<\/a><\/div>\n<\/div>\n

    Solution #3: Figure out when the Service’s Process was Started<\/h2>\n

    Each running windows service is backed by an underlying process. 99.9% of the time, that process was launched immediately when the service started. So finding the process start time will give us the service start time.<\/p>\n

    To find out when the service’s process was started:<\/p>\n

      \n
    1. \n

      Determine the process identifier (PID) of the service’s process using the SC command. For a service named MyService, run:<\/p>\n

      sc queryex MyService<\/b><\/p><\/blockquote>\n

      (Be sure to enclose the service name in quotes if it contains spaces.)<\/p>\n

      \nHere is the result for the Spooler<\/b> service:\n<\/p>\n

      \n
      \n\"Use<\/a>\n<\/p>\n

      Make a note of the number on the PID line (1276 in the screenshot above).<\/p>\n<\/li>\n

    2. \n

      Next, open a PowerShell window<\/a> and run:<\/p>\n

      Get-Process | select name, id, starttime | select-string <PID><\/b><\/p><\/blockquote>\n

      where <PID> is the process identifier from step 1. The start time will come back in the result. Here is what we got for the spooler’s process (#1276):<\/p>\n

      \n
      \n\"Run<\/a>\n<\/p>\n<\/li>\n<\/ol>\n

      \n
      \n
      \"\"<\/a><\/div>\n<\/div>\n

      Solution #4: Use the System Boot\/Up Time (for Automatic Windows Services)<\/h2>\n

      Most Windows Services start when your computer boots and run continuously, 24×7 in the background. For those services, the system boot time is a reasonable approximate.<\/p>\n

      You can run the built-in systeminfo<\/a> command to discover when the system last started. Amongst the valuable information systeminfo returns, look for the “System Boot Time” line:<\/p>\n


      \n\"System<\/a><\/p>\n

      However, if you’re ever in a situation where you can’t remember the command to use, know that the Task Manager’s Performance tab shows how long the computer has been up (“Up time”). The system boot time is a simple calculation away.<\/p>\n


      \n\"Task<\/a><\/p>\n

      \n
      \n
      \"\"<\/a><\/div>\n<\/div>\n

      So there are four easy ways to find out when your windows service started. Use whichever one best fits your situation. Good luck with your troubleshooting\/investigation!<\/p>\n

      \n
      \n\n\n\n
      More articles about Windows Services…<\/nobr><\/span><\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n