Event ID 7036InformationSystem

Windows Event ID 7036 — Service State Changed

Logged when a service enters a running or stopped state.

Why It Matters

Tracking state changes for security-critical services (Windows Defender, Windows Firewall, Event Log) can reveal tampering. A security service stopping without a corresponding start shortly after is a red flag.

Key Fields

Service NameThe service that changed state
StateRunning or stopped

Investigation Tips

  1. 1.Monitor for Windows Defender (WinDefend) or Firewall (MpsSvc) stopping without a corresponding start.
  2. 2.Pair with 7034 to distinguish crashes from intentional stops.

Go deeper: the full Windows Defender Disabled or Tampered guide

Explore the related technique, investigation steps, and evidence to consider alongside this event.

Read the Windows Defender Disabled or Tampered guide →

See Event ID 7036 in your logs

Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.

Decode an event →
← All detection guides·Decode an event →