Troubleshooting Windows Server 2008 R2 Service Startup Issues (Part 1)

by [Published on 28 June 2011 / Last Updated on 28 June 2011]

This article discusses the basics of troubleshooting failed system services, including verifying an error message and tracking down information in the event logs.

If you would like read the next part of this article series please go to Troubleshooting Windows Server 2008 R2 Service Startup Issues (Part 2).

Introduction

Troubleshooting a service failure can sometimes be a frustrating experience. Thankfully, there are some techniques that you can use to get to the cause of the problem and get your server up and running relatively quickly. In this article, I want to discuss various techniques that you can use to troubleshoot service failures.

Before I Begin

Before I get started, I just want to quickly mention that all of the screen shots presented in this article series are based on Windows Server 2008 R2. Even so, most of these techniques will work on other versions of Windows as well. The exact steps may not always match up perfectly from one operating system to another, but the basic concepts are relevant across the board.

Verify the Failure

Even though it sounds silly, the very first thing that you should do when you see an error message sighting a service failure is to verify that the error is accurate. I have seen several real world examples of buggy application of the report service failures when the services is actually running. Likewise, it is very common to see an error message when Windows is booted indicating that one or more services have failed to start. This message is often erroneous.

To verify a service failure, you need to open the Service Control Manager by selecting the Services command from the Administrative Tools menu. The Service Control Manager lists every service that is installed on the machine, as well as the services current state. You can see with the Service Control Manager looks like in Figure A.


Figure A: The Services console displays all of the system services.

If the error message that you have received relates to a specific service then you can simply locate the service within the Service Control Manager (services are arranged alphabetically) and check to see whether or not the service is started. If on the other hand you have received a generic error message stating that one or more services failed to start then you need to look to find out whether or not the services that should be running really are.

As you look at the figure above, you might notice that not all of the services are running. This is normal and has to do with the service’s startup type. Windows offers four different startup types for services (some of the older versions of Windows only use three startup types). These include:

Automatic – Services with a startup type of Automatic should start automatically when Windows is booted.

Automatic (Delayed Start) - Automatic services that are configured with the delayed start wait until all of the other automatic services have started before they begin initializing. Even at that, automatic services that use a delayed start use a low priority thread to ensure that the server remains responsive while the services are starting.

Manual - Services that are configured to start manually do not start unless they are instructed to do so either by you, by the operating system, or by an application.

Disabled - If a service is disabled it will not start even if you attempt to manually start the service. Some services are disabled for security reasons, but there are also documented instances of malware disabling system services in order to prevent them from running. If you need to start a disabled service, you can do so by changing the startup type to either Manual or Automatic (or Automatic Delayed Start) and then starting the service.

If you are trying to determine whether or not the necessary services are running, then simply scroll through the list of services and make sure that every service that has a startup type of Automatic or Automatic Delayed Start is running. If a service is configured to run automatically, but is not started the mess services likely the cause of the error.

Manually Start the Service

If you notice that a service that should be running is not running, then the first thing that you should do is to attempt to manually start the service. To do so, just right click on the service and choose the Start command from the resulting shortcut menu. Often times, the service will start without any problems.

Check the Event Log

So what you do if you attempt to manually start a system service, but it does not start? The first thing that I recommend doing in such situations is to check the Event Viewer. In most cases when a service fails to start, one or more event log entries will be created. These log entries can be invaluable in helping you to determine the root cause of the problem.

The location in which the event log entry is created really depends on the type of service that you are having trouble with. There are three main event logs that could potentially contain information about the service that you're having trouble with. These include:

  • The System Log space – The System Log contains events related to the Windows operating system. If you are having trouble starting a service related to the Windows Operating System then the System Log is the best place to look for information.
  • The Applications and Services Logs space – Newer versions of Windows include a set of logs known as the Application and Services Logs. These logs are application specific. In other words, if you are looking for log entries related to a certain application, then this is the first place that you should look. The Applications and Services Logs container contains dedicated logs for things like Internet Explorer, Microsoft Office, and Windows PowerShell.
  • The Application Log space – most applications do not create a dedicated logs beneath the Applications and Services Logs container. Instead, application related logging information is usually written to the Application log.

Even though the event logs can be a valuable resource for troubleshooting a service that fails to start, it can sometimes be tough to find the information that you are looking for. After all, there are typically thousands of event log entries scattered across a dozen or more logs. If you have trouble locating information related to the service that you are having trouble with, then I recommend using the Event Viewer’s Find feature (which is located in the Actions pane). The Find feature works like a search engine and allows you to search for text related to the problem that you are having, as shown in Figure B.


Figure B: You can search the event logs for specific text.

When you find a log entry related to your problem, just double-click on the entry to view it. Sometimes the log entry will tell you exactly what the problem is. For example, the log entry shown in Figure C indicates that the service was disabled. This problem is easy enough to fix by re-enabling the service. Sometimes however, the solution is not quite so clear-cut. In these situations it is sometimes useful to make note of the event ID number so that you can look it up on the Internet if necessary. Often times, Microsoft provides TechNet articles with comprehensive solutions for specific event IDs.


Figure C: Sometimes event log entries will tell you exactly why a service failed to start.

Conclusion

Now that I have talked about the basics of troubleshooting a stubborn service, I want to move on to some of the more intermediate and advanced troubleshooting techniques. I will discuss these techniques in Part two.

If you would like read the next part of this article series please go to Troubleshooting Windows Server 2008 R2 Service Startup Issues (Part 2).

Advertisement

Featured Links