If you need to find out when a Windows service started last, you can use a few different approaches which include:
PowerShell
Event Viewer
Windows CMD/PowerShell
To run a PowerShell query, you can do so like this:
(Get-EventLog -LogName “System” -Source “Service Control Manager” -EntryType “Information” -Message “*My Service service*running*” -Newest 1).TimeGenerated
PS C:\Windows\system32> (Get-EventLog -LogName “System” -Source “Service Control Manager” -EntryType “Information” -Message “*My Service* service*running*” -Newest 1).TimeGenerated
Monday, November 23, 2020 9:20:43 AM
Search the Windows Event Logs using the Event Viewer
Instead of running a PowerShell command, you can also search the Event Log manually.
To find the event log record showing when your service was last started:
Open the Event Viewer from the Control Panel (search for it by name).
In the left-hand column, navigate to Windows Logs > System:
Event Viewer – Open System Log
Click Find… on the right to bring up the Find window. Enter the name of the service and click the Find Next button to highlight the first matching record in the middle panel. We have entered Spooler, for the Windows Spooler service:
Event Viewer – Find
If necessary, keep clicking the Find Next button until a record saying that your service has “entered the running state” comes up. The Source should be Service Control Manager, and the time your service started will be displayed in the Logged value. The screenshot show that the Print Spooler service last started at 8:04:55 AM on January 7th 2017:
Print Spooler service start time
Determine the process identifier (PID) of the service’s process using the SC command. For a service named MyService, run:
sc queryex MyService
The output will provide you the PID which you can use to query the start time of the process.
Next launch PowerShell to find thee start time.
Get-Process | select name, id, starttime | select-string
