(888) 881-CORE
Here are four ways to determine when your windows service last started.
Solution #1: Search the Windows Event Logs with PowerShell
The Windows Event Logs hold a wealth of information about your computer’s activities. Indeed, a new record is added to the System event log whenever a windows service starts or stops.
The easiest way to find your service’s most recent start time is to use a specially crafted PowerShell command to search the System event log. For example, the following line will return the last time the “Print Spooler” service was started:
(Get-EventLog -LogName "System" -Source "Service Control Manager" -EntryType "Information" -Message "*Print Spooler service*running*" -Newest 1).TimeGenerated
Be sure to replace "Print Spooler" with the display name of the service you are investigating!
Solution #2: Search the Windows Event Logs using the Event Viewer
Instead of running a PowerShell command, you can also search the Event Log manually.
To find the event log record showing when your service was last started:
Open the Event Viewer from the Control Panel (search for it by name).
In the left-hand column, navigate to Windows Logs > System:
Click Find… on the right to bring up the Find window. Enter the name of the service and click the Find Next button to highlight the first matching record in the middle panel. We have entered Spooler, for the Windows Spooler service:
If necessary, keep clicking the Find Next button until a record saying that your service has “entered the running state” comes up. The Source should be Service Control Manager, and the time your service started will be displayed in the Logged value. The screenshot show that the Print Spooler service last started at 8:04:55 AM on January 7th 2017:
Solution #3: Figure out when the Service’s Process was Started
Each running windows service is backed by an underlying process. 99.9% of the time, that process was launched immediately when the service started. So finding the process start time will give us the service start time.
To find out when the service’s process was started:
Determine the process identifier (PID) of the service’s process using the SC command. For a service named MyService, run:
sc queryex MyService
(Be sure to enclose the service name in quotes if it contains spaces.)
Here is the result for the Spooler service:
Make a note of the number on the PID line (1276 in the screenshot above).
Next, open a PowerShell window and run:
Get-Process | select name, id, starttime | select-string <PID>
where <PID> is the process identifier from step 1. The start time will come back in the result. Here is what we got for the spooler’s process (#1276):
Solution #4: Use the System Boot/Up Time (for Automatic Windows Services)
Most Windows Services start when your computer boots and run continuously, 24×7 in the background. For those services, the system boot time is a reasonable approximate.
You can run the built-in systeminfo command to discover when the system last started. Amongst the valuable information systeminfo returns, look for the “System Boot Time” line:
However, if you’re ever in a situation where you can’t remember the command to use, know that the Task Manager’s Performance tab shows how long the computer has been up (“Up time”). The system boot time is a simple calculation away.
So there are four easy ways to find out when your windows service started. Use whichever one best fits your situation. Good luck with your troubleshooting/investigation!
Worked fine on windows 7 machines but not in windows 10. I also had issues when tried to filter the source “”Service Control Manager’.. also, when to event viewer, reset spooler couldn’t find the service log.. any idea why? It’s also happening on more than one machine on win10..
Hi idalberto. Are you an administrator on the machine? Please send the details (to support@CoreTechnologies.com), including the following:
We’ll help you get to the bottom of it soon!
The service is the spooler. I’ll send more details to the support email. Notice on Windows 10 in the Event Viewer there is stop/start event of any service.
Very useful Post. We saved one client escalation with the help of this post.
I have created a windows service with Automatic Start Type and install it in my system successfully but it does not start until i restart my system. Details: yesterday i have create and install my service and then restart my windows so the service started successfully. but the problem occurred today when i boot my windows and opened the services list of windows from Control Panel\Administrative Tools\Services and selected my service i saw that it did not start automatically. what is my mistake?
Hi.
Sometimes services start too early, before the systems they need are not fully initialized.
Please try setting your service to start “Automatic (Delayed Start)” and see if that helps.
Hi
Thank you for this command, that is great, I need to know when this service was disabled or stopped? Are you able to provide the power shell command for it please?
Hi Dev.
Unfortunately we don’t know of any Powershell command that reveals when a service was disabled or stopped.
i did the same thing as Solution #3 , but in result I got StartTime =}
why i didn’t have any time in result?
I had to open pwershell as Adminstrator. 🙂
services.msc should have a “Started” column, for the time the services was last started, or even show the time in the Status column instead of just “Running”