Context
A Windows service cannot start and reports a logon failure. The service executable may be intact; Windows failed to establish the configured account context before normal application startup. Changing the service to a more privileged identity can obscure the cause and alter its access to local and network resources.
Prepare the exact service name, System event timestamp, configured account type and application support procedure. Distinguish local users, domain accounts, built-in identities and managed service accounts. Read-only inspection is the first step. Password or account changes should follow the identity owner's process and must not place secret values in a command transcript.
Inspect identity and logon evidence
- Read the service's configuration through Services or
Get-CimInstance Win32_Service, selecting the specific service's name, start account, path and state. Compare it with the application owner's intended identity. A display name can differ from the internal service name, and a related helper service can use a different account. - Inspect the matching Service Control Manager event in the System log. Events such as 7038 or 7041 can provide more useful detail than the generic start dialog. Record the exact sanitized reason: incorrect password, disabled account, missing right or another logon condition. Avoid grouping every start failure under one universal credential fix.
- Review account state and the effective service-logon authorization through the responsible identity/security administrator. A user account's ability to sign in interactively does not prove the required service logon right. Deny assignments and managed policy can also matter. This is a specific service-account review, not a reason to change unrelated organization-wide policy.
- Identify application-specific account-management tools. Some products maintain related permissions or configuration when changing their service identity, and a generic Services edit may bypass those steps. For managed service accounts, follow the supported host and account setup rather than typing an ordinary password into a field.
An illustrative rotation mismatch
In an illustrative business integration service, the domain account password rotates but the service configuration is not updated through the application's supported mechanism. The next restart fails even though the previous running process had continued. The correct recovery connects the rotation owner with this consumer; granting local administrator rights would not reconcile the credential lifecycle.
| Observation | Evidence required | Correction boundary |
|---|---|---|
| Incorrect-password event | Rotation history and configured consumer | Credential synchronization |
| Missing logon-right event | Effective service authorization | Local or managed rights assignment |
| Disabled or locked account | Identity-owner state | Account lifecycle |
| Starts manually after boot only | Exact events and startup timing | Dependency or identity availability |
Correct and verify the intended identity
Restore the approved account relationship using the application's supported tools. Keep privileges no broader than required and preserve a rollback record without storing passwords in it. If the account is shared across services, inventory those consumers before another rotation or account disablement.
Start the service through the planned procedure and verify the resulting process identity, application health and required resource access. Include an authorized restart test where appropriate; a surviving process from before rotation does not establish future logon success. Confirm the original event no longer recurs.
Maintain a consumer inventory
Document service names, account owners, rotation mechanism, required logon rights and application verification steps. Monitor service-start failures separately from application runtime errors. Clouvenix Windows administration can help align service identities with a recoverable operating procedure.
Technical reference
Microsoft logon-failure diagnosis, service logon rights and service account context.