ZEKASTRA

SystemSystem and services

7036 · A service entered a new state

Logged by the Service Control Manager when a service enters a new state, for example running or stopped.

01Fields in the event

The cited Microsoft page does not list field names for this event.

02How to use it

Shows when services such as Windows Defender, Event Log or Remote Desktop were stopped or started; place these transitions on the timeline next to logons and process creation.

03Caveats

Very frequent and does not record who requested the change. Cited from archived Windows Server 2008 R2 documentation.

05Sources

  1. Microsoft Learn — Event ID 7036 — Basic Service Operations checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.