Windows Event ID 7034 – Service Control Manager: Service Crashed Unexpectedly

Start by locating the specific Event ID 7034 entries to identify which service is failing:

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. In the Actions pane, click Filter Current Log
4. Enter 7034 in the Event IDs field and click OK
5. Review recent entries to identify the failing service name and frequency

Use PowerShell for more detailed analysis:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=7034} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

This command shows the last 50 service crash events with full details. Look for patterns in timing or specific service names that appear repeatedly.

Once you've identified the failing service, examine its configuration and dependencies:

1. Open Services console by running services.msc
2. Locate the service that's crashing and double-click to open Properties
3. Check the Dependencies tab to see what services this one depends on
4. Verify all dependency services are running and configured correctly
5. Review the Log On tab to ensure the service account has proper permissions

Use PowerShell to get comprehensive service information:

$serviceName = "YourServiceName"
Get-Service $serviceName | Format-List *
Get-WmiObject Win32_Service -Filter "Name='$serviceName'" | Select-Object Name, State, StartMode, ServiceType, PathName

Check if the service executable exists and is accessible:

$service = Get-WmiObject Win32_Service -Filter "Name='$serviceName'"
Test-Path $service.PathName.Split('"')[1]

Service crashes often generate additional events in Application or System logs that provide more context:

1. In Event Viewer, check Windows Logs → Application for errors around the same time as Event ID 7034
2. Look for Application Error events (Event ID 1000) or Windows Error Reporting events (Event ID 1001)
3. Check Applications and Services Logs for service-specific logs

Use PowerShell to correlate events across multiple logs:

$startTime = (Get-Date).AddHours(-24)
$events = @()
$events += Get-WinEvent -FilterHashtable @{LogName='System'; Id=7034; StartTime=$startTime}
$events += Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1000,1001; StartTime=$startTime}
$events | Sort-Object TimeCreated | Format-Table TimeCreated, Id, LogName, Message -Wrap

This script shows all service crashes and application errors from the last 24 hours, helping identify patterns or related failures.

Configure or review service recovery options to prevent future crashes from causing extended downtime:

1. In Services console, right-click the failing service and select Properties
2. Click the Recovery tab to see current recovery actions
3. Configure appropriate recovery actions: Restart the Service, Run a Program, or Restart the Computer
4. Set reasonable reset failure count intervals (typically 24 hours)

Use PowerShell to configure service recovery programmatically:

# Configure service to restart on failure
sc.exe failure "YourServiceName" reset= 86400 actions= restart/60000/restart/60000/restart/60000

Check current recovery configuration:

sc.exe qfailure "YourServiceName"

For persistent service crashes, use advanced diagnostic tools to identify the root cause:

1. Download and run Process Monitor from Microsoft Sysinternals
2. Set filters to monitor only your failing service process
3. Start the service and monitor file, registry, and network activity until it crashes
4. Look for access denied errors, missing files, or registry issues in the log

Configure automatic crash dump collection:

# Enable crash dumps for the service
$serviceName = "YourServiceName"
$regPath = "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\$serviceName.exe"
New-Item -Path $regPath -Force
Set-ItemProperty -Path $regPath -Name "DumpFolder" -Value "C:\CrashDumps"
Set-ItemProperty -Path $regPath -Name "DumpType" -Value 2
Set-ItemProperty -Path $regPath -Name "DumpCount" -Value 5

Create the dump folder:

New-Item -Path "C:\CrashDumps" -ItemType Directory -Force
Icacls "C:\CrashDumps" /grant "Everyone:(OI)(CI)F"