Windows Event ID 31 – System: Service Control Manager Timeout

Start by examining the specific Event ID 31 details to identify the problematic service and timeout circumstances.

1. Open Event Viewer → Windows Logs → System

2. Filter for Event ID 31 using the filter option or search functionality

3. Review recent Event ID 31 entries and note the service names, operation types, and timestamps

4. Use PowerShell to query timeout events programmatically:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=31} -MaxEvents 20 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

5. Extract service names from the event messages:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=31} -MaxEvents 10 | ForEach-Object { $_.Message -match 'service (.+?) did not respond' | Out-Null; $Matches[1] } | Sort-Object -Unique

6. Document the frequency and timing patterns of these events to identify trends

Investigate the current status and configuration of services generating timeout events.

1. Check the current status of the problematic service:

Get-Service -Name "ServiceName" | Select-Object Name, Status, StartType, ServiceType

2. Examine service dependencies that might cause startup delays:

Get-Service -Name "ServiceName" -DependentServices

Get-Service -Name "ServiceName" -RequiredServices

3. Open Services.msc and locate the problematic service

4. Right-click the service → Properties → Dependencies tab to view dependency chain

5. Check if dependent services are running properly:

$ServiceName = "YourServiceName"
$RequiredServices = Get-Service -Name $ServiceName -RequiredServices
$RequiredServices | ForEach-Object { Get-Service $_.Name | Select-Object Name, Status }

6. Review service startup type and consider changing from Automatic to Automatic (Delayed Start) for non-critical services

Analyze system resource utilization to identify bottlenecks causing service timeouts.

1. Use Performance Monitor to track resource usage during system startup:

2. Open perfmon.exe and create a new Data Collector Set

3. Add counters for:

• Processor: % Processor Time
• Memory: Available MBytes
• PhysicalDisk: % Disk Time
• PhysicalDisk: Avg. Disk Queue Length

4. Monitor resource usage with PowerShell during service operations:

Get-Counter "\Processor(_Total)\% Processor Time", "\Memory\Available MBytes", "\PhysicalDisk(_Total)\% Disk Time" -SampleInterval 2 -MaxSamples 30

5. Check for memory pressure that might affect service startup:

Get-WmiObject -Class Win32_OperatingSystem | Select-Object TotalVisibleMemorySize, FreePhysicalMemory, @{Name="MemoryUsagePercent";Expression={[math]::Round((($_.TotalVisibleMemorySize - $_.FreePhysicalMemory) / $_.TotalVisibleMemorySize) * 100, 2)}}

6. Identify processes consuming excessive resources during startup:

Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 Name, CPU, WorkingSet

7. Consider increasing system resources or optimizing startup sequence if resource constraints are identified

Adjust service timeout registry values to accommodate services that legitimately require longer startup times.

1. Create a registry backup before making changes:

reg export HKLM\SYSTEM\CurrentControlSet\Control C:\Backup\ServiceControl_backup.reg

2. Navigate to the service timeout registry location:

HKLM\SYSTEM\CurrentControlSet\Control

3. Modify the ServicesPipeTimeout value (default is 30000 milliseconds):

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control" -Name "ServicesPipeTimeout" -Value 60000 -Type DWord

4. For specific services, navigate to their individual registry keys:

HKLM\SYSTEM\CurrentControlSet\Services\[ServiceName]

5. Add or modify service-specific timeout values if supported by the service

6. Restart the system to apply registry changes:

Restart-Computer -Force

7. Monitor Event Viewer after restart to verify timeout events are resolved

Implement comprehensive service recovery strategies and advanced diagnostic techniques.

1. Enable detailed service logging for problematic services:

wevtutil sl Microsoft-Windows-Services/Diagnostic /e:true

2. Configure service recovery options through Services.msc:

Open Services.msc → Right-click service → Properties → Recovery tab

Set recovery actions: Restart the Service, Restart the Service, Take No Action

3. Use Process Monitor (ProcMon) to trace service startup activities:

Download ProcMon from Microsoft Sysinternals and filter by the service process name

4. Analyze service executable dependencies:

$ServicePath = (Get-WmiObject Win32_Service -Filter "Name='ServiceName'").PathName
Get-Command $ServicePath.Split('"')[1] | Select-Object FileVersionInfo

5. Check for corrupted service files and repair if necessary:

sfc /scannow

DISM /Online /Cleanup-Image /RestoreHealth

6. Create a custom service monitoring script:

$ServiceName = "YourServiceName"
while ($true) {
    $Service = Get-Service -Name $ServiceName
    if ($Service.Status -ne "Running") {
        Write-Host "$(Get-Date): $ServiceName is $($Service.Status)"
        Start-Service -Name $ServiceName
    }
    Start-Sleep -Seconds 30
}

7. Implement Windows Event Forwarding to centralize timeout event monitoring across multiple systems