Skip to content
littleden.blogEvidence-led Windows troubleshooting, without the guesswork
FixesError codesComponentsCommandsWindows updatesWindows 11
Research statusMethodology
Windows command reference

Get-WinEvent — Service Control Manager

Read recent Service Control Manager events efficiently from the System log so service-start/dependency/crash timing can be correlated.

Risk: LowReviewed: 2026-09-17
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Service Control Manager'; StartTime=(Get-Date).AddHours(-24)}

When to use it

Use when a service failure is recent and you need the matching SCM event history without changing the log.

When not to use it

This can return many events; narrow the time or Event ID as needed. Do not clear the System log while troubleshooting.

Primary reference

Reviewed source

Related authority records

Continue with the same failing system

These links share the same component or repair context; they are not generic keyword suggestions.

CommandSC Query

Display status and service-control information for a named Windows service or driver service.

ErrorEvent ID 7000 — Service Control Manager: a service failed to start

Use the named service and complete error text to determine whether the failure is timeout, configuration, binary, permission or another service-specific cause.

ErrorEvent ID 7001 — Service Control Manager: dependency service failed to start

A higher-level service can fail because one of its required services failed first; trace the dependency chain instead of repairing only the visible service.

CommandGet-Service

List Windows service objects and their current status; specific service names can be queried and required/dependent services can also be inspected.

CommandSystem Configuration (MSConfig)

Open System Configuration, including the service/startup controls Microsoft uses in its clean-boot troubleshooting procedure.

GuideWindows 11 starts slowly: build a startup evidence timeline before disabling services

Separate boot delay, sign-in delay and post-desktop startup load, then correlate recent changes and startup items before broad service changes.