5 Ways to Identify a Failed Service or Driver During Startup

If you’re still working in an environment with older operating systems such as Windows NT, 2000 or 2003 being used, one of the annoying error messages they can popup is a dialog box during or just after Windows has booted. It will have a message with “At least one service or driver failed during system startup. Use Event Viewer to examine the event log for details”. This can happen when software or drivers don’t get uninstalled correctly or the startup entry isn’t removed from services.

It’s usually not a big problem because when you click the OK button, the error message will go away and you won’t be bothered by this error message again until you restart Windows. The problem does need investigating though because it could be related to system services or drivers which have an issue and are affecting functions such as the network or causing system performance or instability.

Unfortunately, there’s no 100% one click fix for this error and the only way you can really find out the cause is by manually checking which service or driver has failed to load through some detective work. We can only guide you on where to check for the fault because fixing it will depend entirely on what has failed and your Windows software configurations etc.

Here are a few ways you can help identify which service or driver failed during system startup.

1. Identify the Failure Using Event Viewer

You can use Event Viewer to locate the error which is obviously what the message suggests. The error doesn’t always show up here depending on what’s gone wrong, but is the logical place to start.

Run Event Viewer from Control Panel -> Administrative Tools -> Event Viewer. By default it has 3 categories called Application, Security and System. The first and most likely category to check is System which is where most of the events occur related to service and driver activity. Application would be the second choice, followed by Security.

As you can see, the screenshot in this scenario shows a warning for the DHCP Client Service shutting down and then a failure error from the Service Control Manager saying the service has terminated. An error along these lines in Event Viewer would likely be the culprit for the startup dialog box as this service should automatically start with Windows.

2. Identify the Failed Service in Services Manager

A simple way to detect a service not loading when it should have, is to open the Windows Service Manager. You can run Service Manager from Control Panel -> Administrative Tools -> Services. Then sort the services by the Startup type column.

Go through all the services that are set to Automatic and make sure the ones that need to be are started. This does require a small amount of knowledge about the system though as some services start and then stop themselves automatically if they aren’t required. As we can see from the screenshot example, the DHCP Client service should be started and isn’t, so is the cause of our problem.

3. Display Stopped Automatic Services with a Script

IntelliAdmin have created a small VBscript that will go through all services on a system and display the ones that are set to automatic and have not started, similar to the display in the Services Manager. The script is not perfect though and sometimes manual services are started by other services at startup, and those will not show up with the script.

You must run the script via Command Prompt and use cscript.exe to execute the it.

cscript.exe ListFailedServices.vbs

Make sure that you’re in the directory where the ListFailedServices.vbs is located, for example, place it in C and use “cd c:\” before running the script.

The “Caption:” is the name to look at because it will be the one you can identify easily in Services Manager.

Download ListFailedServices.vbs Script

4. Detecting a Faulty Software Driver

If your services all look in order, the problem could be due to a faulty software driver which you can locate using Device Manager. Go to System Properties -> Hardware -> Device Manager. Then click the View menu and tick “Show hidden devices”. If it isn’t already open, expand the “Non-Plug and Play Drivers” tree and look for any entries with a yellow exclamation.

Anything which shows up with the yellow mark shows it has a problem and could be the cause of the error. From there you can identify the problem driver and look for the appropriate solutions.

5. Using a Small Utility to List Services and Drivers

As you can see, the problems can be found by using various methods in Windows, but there is a useful little tool by NirSoft that can list both services and drivers from the same program. ServiWin is both tiny and portable while giving you a great deal of information about the status of system services and drivers.

Just run the executable and then you can switch between services (F8) or drivers (F7) being displayed in the main window. The service or driver lists can be saved to a file or HTML report for others to help troubleshoot the problem, the corresponding registry entries can be opened in Regedit, the filename can be searched for in Google and also ServiWin can connect to remote computers and display the information for another machine. A valuable little tool to have around and it works on Windows 2000 or newer operating systems.

Download ServiWin