How to repair services that won't start (Service Control Manager)

When an essential Windows service fails to start and the Service Control Manager starts filling the Event Viewer with errors (7000, 7001, 7003, 7023, 1060, 1068, etc.), the system can become almost unusable: no network, no sound, no Xbox, no updates, no domain login… and the feeling that the only option left is to format. The good news is that Windows includes very powerful tools for diagnosing and repairing these problems before reaching the final disaster of reinstalling everything.

In this guide you will see, step by step and in great detail, how diagnose why a service is not starting (whether it's Netlogon, an Xbox service, Workstation, etc.) and how to properly use SFC, DISM, and CHKDSK to repair system files, the Windows image, and the disk itself. We will also review Typical errors of the Service Control Managerhow to interpret their messages and what to do when even these tools are not enough.

What is Service Control Manager and why do services fail?

In Windows, the Service Control Manager (SCM) is the component responsible for manage the service lifecycleIt starts and stops processes, controls their dependencies, and logs errors when something goes wrong. When you see events like 7000, 7001, 7003, 7023, or error codes like 1060, 1068, 13, etc., it's the SCM that's recording them in the event log.

A service may fail to start for a thousand reasons, but the most common are misconfigured dependencies, corrupted files, or missing binaries/DLLsSometimes the problem seems small (for example, the Xbox app isn't working), but behind it lies a key service that Windows is unable to start because Something in the configuration or system files is broken.

Symptoms can range from minor issues (a specific app malfunctioning) to serious system failuresNetwork services that won't start, Windows Update crashing, inability to join a domain, loss of sound, or frequent blue screens. That's why it's crucial to understand what's really happening before randomly changing anything.

Typical errors of services that do not start (Service Control Manager)

When a service crashes, the Event Viewer usually provides fairly clear clues. It's a good idea to get into the habit of always checking it. "System" log filtered by "Service Control Manager" sourceThese are some classic mistakes and what they mean in practice.

Event 7000 indicates that A service could not be started It is usually accompanied by a message such as "The system cannot find the file specified" or "Access denied." At this point, we know that either the executable's path (ImagePath) is incorrect, the file is missing, or there is a permissions problem.

Event 7001 is very common in dependency problems: "Service X depends on service Y, which could not be started."It's the typical waterfall where Workstation (LanmanWorkstation) doesn't start because another dependency is disabled, and Netlogon doesn't start either because it depends on Workstation, and so on.

Event 7003 warns that A dependency has been defined that does not exist"The Netlogon service depends on the following service: Contoso_Service. This service may not be installed." In other words, the registry contains a service name in the DependsOnService key that no longer corresponds to any actual service.

Event 7023 usually accompanies a service that It closes immediately after attempting to start., returning an error code (for example, 1060, service does not exist). This is often seen when a system component has been damaged and the service terminates unexpectedly.

Real-world examples: Xbox services and Netlogon errors

To put all this into perspective, think of two very common cases: the Xbox services on Windows 10/11 and the classic Netlogon service on computers joined to a domain.

In the first case, a user tries to use the Xbox app and, suddenly, The login window opens and closes by itselfLooking at services, it's clear that "Xbox Live Auth Manager" isn't starting and is throwing "Error 13: Invalid data." Another service, "Xbox Live Game Save," returns "Error 1068: The service or dependency group failed to start," because it depends on the first one. "Xbox Live Networking Service" is working. The result: everything points to... The configuration data or files of the main service are corrupted..

In the case of Netlogon in a domain environment, failures are even more critical. Netlogon is the service that It manages domain logon operations, NTLM, Kerberos (PAC), domain controller (DC) discovery, and computer account password maintenance.If this service doesn't start, things like the following will break:

• Domain login and establishing secure sessions with domain controllers.
• Sharing SYSVOL and NETLOGON resources on domain controllers.
• Updating DNS SRV records required for clients to locate a DC.
• Trust relationships between domains and time synchronization with W32Time.

When Netlogon fails to start due to corrupted dependencies (for example, Workstation or Server failing), the event log shows a string of 7001 errors, and other services such as W32Time or the Group Policy service starts logging warnings (for example, events 159, 130, 1110) because they cannot talk to Netlogon or a DC.

How service dependencies work in Windows

All of this is complicated because of Windows services. They are not isolated, they support each otherThis relationship is called a "dependency" and is managed from within the Service Control Manager itself.

If you enter services.msc, right-click on a service, Properties, "Dependencies" tabYou'll see a sort of tree structure that shows which services that service depends on, and which other services depend on it. For example, Netlogon on a domain controller depends on LanmanWorkstation and LanmanServer, and those in turn depend on other components like the browser, SRV2, SRVNET, NSI, etc.

This information isn't magic: it's stored in the registry, in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ServiceNameWithin each service key there is a DependsOnService value with the list of services that must be active before it can start.

You can also view the configuration via the command line using the sc.exe utility. The command sc qc netlogon It returns, among other data, the service binary, the startup type, and dependencies (for example, "DEPENDENCIES: LanmanWorkstation: LanmanServer"). This is very useful for checking if someone has made unauthorized changes.

When a dependent service fails to start, all services that depend on it will also fail. fail in cascadeThat's why it's so important to identify which is the first service in the chain that doesn't start, instead of just focusing on the one you're interested in (Netlogon, Xbox, etc.).

Common causes: corrupted files and configuration errors

Many of the problems with services that fail to start have a common denominator: corruption in system files or in the registry itselfAnd this corruption doesn't appear out of thin air; it's usually caused by very specific situations.

A typical cause is the sudden shutdowns, power surges, or forced restarts While Windows is writing to the disk, critical system files or shared DLLs may be accessed at that time, leaving them in an inconsistent state. When the service reloads them, it encounters a corrupted file.

Another classic source of problems are the Windows updates that partially failA power outage, network problems, conflicts with drivers or security software… The result is that some components have been updated while others haven't, creating an impossible puzzle. That's why after certain problematic updates, waves of errors 7000, 7023, or blue screens of death are seen.

Nor should we forget malware. Viruses, Trojans, and other "joys" can modify, delete or replace Windows DLLs and executablesSometimes they do it deliberately to persist in the system, other times they simply break things as a side effect. In both cases, you end up with services that won't start because the executable or a linked library has become unreliable.

Finally, there are the Hardware failures: bad sectors, dying disks, faulty SSDsIf the disk areas where system files or registry hives reside begin to fail, you'll see symptoms such as extreme slowness, random crashes, and recurring service errors. CHKDSK is often the canary in the coal mine for these types of problems.

Key tools: SFC, DISM and CHKDSK (and how they differ)

Windows comes with three built-in console utilities that are like a Swiss Army knife for repair services that fail to start due to system corruptionThey don't have a pretty interface, but they do the job better than most third-party programs.

The System File Checker (SFC) is dedicated to Analyze all protected Windows files and compare their integrity with a trusted copy stored in the Windows File Protection (WFP) cache. If it detects a corrupted or missing file, it automatically replaces it from that cache.

DISM (Deployment Image Servicing and Management) is in a different league: it works with the complete image of Windows (the "skeleton" of the system)Compare the current state of the system with a clean image (local or online) and, if it sees differences due to corruption, download or take the necessary files from the correct source and restore them.

CHKDSK (Check Disk), on the other hand, does not directly touch system files, but rather Check the status of the file system and the physical sectors of the disk.It detects logical errors in the NTFS/FAT structure and bad sectors, and attempts to mark the damaged ones and recover as much information as possible.

In short: SFC repairs system files, DISM repairs the Windows image, and CHKDSK repairs the disk.Knowing when to use each one (and in what order) makes the difference between recovering the equipment or spending all day groping in the dark.

How to use SFC /scannow to repair system files

The SFC command is the first tool you should use when you suspect that Some component of Windows is brokenServices that do not start, "file not found" errors when running basic tasks, or continuous Windows resource protection messages.

To run it on Windows 7, 8, 8.1, 10 or 11, simply open CMD or PowerShell as administrator (search for "cmd" or "powershell" in Start, right-click, "Run as administrator") and launch:

sfc / scannow

This command scans all protected system files, compares them to the trusted copy in %WinDir%\System32\dllcache and automatically replaces any corrupted filesDepending on the situation, several messages may appear at the end:

• "Windows Resource Protection did not find any integrity violations"The system files are fine; the problem is most likely elsewhere (drivers, third-party software, hardware, etc.).
• "Windows Resource Protection found corrupt files and successfully repaired them."Perfect, the detected corruptions have been fixed and in principle nothing more needs to be done, except restart and check if the services are now running.
• "Windows Resource Protection found corrupt files and was unable to fix some of them."That's a bad sign; the cache from which SFC is trying to restore files is also corrupted. This is where DISM comes in.
• "Windows Resource Protection could not perform the requested operation"SFC could not complete the analysis, usually due to conflicts or blocks. It is generally recommended to repeat it in Safe Mode or after running DISM.

There is a whole family of less commonly used but very useful parameters: /verifyonly to check without repair, /scanfile and /verifyfile to analyze specific files, /offbootdir and /offwindir to work with offline systems (for example, from a recovery medium). You can even customize the log file with /offlogfile.

In extreme situations where Windows won't boot even in Safe Mode, you can run SFC from a installation or recovery mediumBoot from the USB/DVD, select "Repair your computer," and open the command prompt. From there, run something like:

sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows

Adapting C: to the drive letter where the Windows installation is mounted in that environment. This allows Repair system files without starting the desktopThis is crucial when critical services don't even allow access to the login screen.

How to use DISM /RestoreHealth to repair a Windows image

When SFC can't handle everything, the next tool on the list is DISM. It's especially useful in Windows 8, 8.1, 10, and 11 when The system file cache is corrupted and SFC has nowhere left to turn to restore the correct files.

DISM can work with several levels of depth. The most relevant parameters are: /checkhealth, /scanhealth and /restorehealthAnd it's important to understand what each person is doing so as not to waste time or make a mess of things.

The /checkhealth parameter is limited to Check if there is already damage recorded in the image from Windows. It's fast and doesn't perform a full scan; it simply checks if the image is known to be corrupt.

With /scanhealth we take it a step further: we perform a a fairly in-depth analysis of the current image looking for inconsistenciesThis can take a few minutes, as it compares numerous components with their expected state. It records any problems detected, but doesn't correct them yet.

Finally, /restorehealth is the "fat" command: analyzes and also repairs the image Using a clean copy as a reference (local or, by default, via Windows Update). This is the one you should run when you suspect damage to components that SFC doesn't fix.

Practical use is simple. Again, open CMD or PowerShell as administrator and run:

DISM / Online / Cleanup Image / RestoreHealth

The /Online parameter indicates that you will be working on the system in executionThe `/Cleanup-Image` command instructs the system to check and repair components of the current image. This process can take a considerable amount of time, especially if you have to Download files from Windows UpdateIdeally, let it finish without touching anything, even if it takes an hour or more.

If for some reason Windows Update isn't working, or your computer doesn't have internet access, you can provide a alternative source of clean filesFor example, another clean Windows installation or the mounted ISO itself. The command would be something like this:

DISM /Online /Cleanup-Image /RestoreHealth /Source:C:\RepairSource\Windows /LimitAccess

Where C:\RepairSource\Windows points to the path containing the "Windows" folder of the reference image (this could be a USB drive, a network share, etc.). The /LimitAccess parameter prevents DISM from attempting to contact Windows Update, using only the specified source.

Windows 7 does not have DISM with these capabilities. Instead, Microsoft provided the System Update Readiness Tool (SURT), downloadable from the Microsoft Update Catalog. Its mission is similar: to analyze the system and repair component inconsistencies that SFC cannot resolve.

How to use CHKDSK /F /R to detect disk errors

If after going through CFS and DISM you still have Random errors, blue screens, extremely slow startup, and services that fail for no apparent reasonIt's time to suspect the disc. That's where CHKDSK comes in.

CHKDSK is a veteran of the Windows ecosystem that handles analyze the file system structure and the physical sectors of the diskIt works with NTFS, FAT, and FAT32 drives, and is able to correct logical errors (inconsistent directory entries, corrupted indexes, damaged security descriptors) and mark bad sectors so that the system does not use them.

A typical command to check the system drive would be:

chkdsk C: / F / R

Here, C: is the letter of the drive to check; /F indicates that you want automatically correct the errors foundand /R to scan for bad sectors and attempt to recover readable data. If you try to do this on the drive where Windows is installed, the system will usually tell you that it cannot lock it right now. It will offer to schedule the check for the next restart.You accept, restart, and let it work.

For NTFS there are some very interesting additional parameters: /scan for an online scan, /spotfix for correct specific points Without a full scan, you can use `/perf` to use more resources and speed up the process, or `/sdcleanup` to clean up unnecessary security entries. These aren't essential for the average user, but they can help in certain situations.

It's important to understand that, although CHKDSK is not designed for delete personal dataMarking sectors as damaged may result in the loss of some of the information stored in those areas. Therefore, it's always recommended to have a backup beforehand if you suspect the disk is damaged.

In what order should you run DISM, SFC, and CHKDSK?

A recurring question is the correct order of these tools. Although some advocate for different sequences, a very sensible approach when services fail to start due to potential corruption is Start with the image, then move on to the system files, and finish with the disk..

In practice, a reasonable workflow would be:

• Run first DISM / Online / Cleanup Image / RestoreHealth to ensure that the Windows image is clean and that SFC will have a reliable source of files to work with.
• Then, launch sfc / scannow so that it repairs all the protected system files it finds damaged, relying on that corrected image.
• If despite everything you continue to experience strange symptoms (extreme slowness, crashes, services becoming corrupted again), run chkdsk /F /R on the system unit and, if applicable, on other data units.

This approach has the advantage that Prevent SFC from attempting to repair files using a corrupted cacheAnd it ensures that any image-level corruption is resolved before delving into the details. Furthermore, if it turns out the disk has bad sectors, you'll have detected them and can consider replacing the drive before the problem worsens.

When there is no other option but to reinstall Windows

However powerful SFC, DISM, and CHKDSK may be, there are cases in which the system is so compromised that It's not worth continuing to patch things upSome clear indications that the time has come to consider a relocation are the following.

If after repeating the commands several times (including running in Safe Mode or from recovery media) The errors persist or return within a few days.It is very likely that there is deeper damage or software conflicts that are difficult to isolate.

In the presence of serious malware infections If someone has manipulated services, system DLLs, and critical configurations, even if you manage to partially clean the system, remnants will usually remain and continue to cause instability. In that case, a clean installation is often the safest option.

When the team shows severe performance issues, constant crashes, random restarts, and erratic behavior If they don't improve after using repair tools, it makes sense to stop wasting hours and start from scratch with a clean installation, always keeping a copy of your documents.

It's also highly recommended to reinstall if you've done major hardware changes (motherboard, main storage, etc.), because although Windows usually adapts, the accumulation of old drivers and previous configurations can be a source of service and device errors.

And of course, when a The major Windows update is incomplete, leaving the system in a semi-functional state. If you can't get out of it with either DISM or SFC, reinstalling usually gives better results than trying to "undo" botched updates.

Quick FAQ

Many questions arise repeatedly when discussing how to repair services that won't start using these utilities. It's worth clarifying some of the most common ones to avoid unpleasant surprises.

One of them is whether Is it safe to run SFC, DISM, and CHKDSK?The answer is yes, provided you run them with administrator privileges and don't abruptly interrupt the process (especially with CHKDSK). These are official Microsoft tools designed precisely for this purpose.

Another common question is which command to use first, SFC or DISM. If the problem seems minor (for example, a feature that fails but the system is reasonably stableYou can start with SFC and, if that doesn't fix everything, move on to DISM. If the symptoms are more serious or you already know there's severe corruption (SFC messages indicating it can't repair files), it's best to start with DISM.

It is also concerning whether these commands can delete personal filesNeither SFC nor DISM are designed to access documents, photos, or user data. CHKDSK doesn't delete them either, but if that data is stored in physically damaged sectors that need to be marked as unusable, you could lose some of it. That's why it's always a good idea to keep up-to-date backups.

Finally, many wonder if you need to be an "advanced user" to use these tools. The reality is that, by following clear steps and taking your time, Any average user can run them without much difficultyWhat is important is to understand what each one does so as not to launch random commands and then not know what happened.

When a Windows service refuses to start, the Service Control Manager leaves a fairly clear trail in the Event Viewer, and the system itself provides plenty of tools to fight back: from checking dependencies in services.msc or the registry to running SFC, DISM, and CHKDSK in the correct order. By combining all of these, in most cases you'll be able to resolve the issue. Recover critical services like Netlogon, Workstation, Xbox components, or Windows Update without formattingAnd if you still can't manage it, at least you'll know it's time for a clean reinstall and you won't waste any more time blindly.