Windows services and event logs cheat sheet
Build a focused picture of service state and recent system errors.
Windows PowerShell 5.1 or supported PowerShell on Windows.
Updated · Windows · 7 min read
| Command | What it does |
|---|---|
Get-Service | List service states |
Get-Service -Name Spooler | Inspect a specific service |
Get-WinEvent -FilterHashtable @{LogName='System'; Level=2; StartTime=(Get-Date).AddHours(-2)} -MaxEvents 30 | Read recent system errors |
Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 | Inspect cumulative CPU usage |
Walkthrough
Use an account permitted to read the selected event log. These commands do not start or stop services.
Step 1: List service states
Get-Service
Find the affected service and its actual status. A stopped service may be intentional; compare against its startup policy and the application runbook.
Step 2: Inspect a specific service
Get-Service -Name Spooler
This example checks Print Spooler. Substitute the service name, not its display label. Record status before considering any restart.
Step 3: Read recent system errors
Get-WinEvent -FilterHashtable @{LogName='System'; Level=2; StartTime=(Get-Date).AddHours(-2)} -MaxEvents 30
Correlate provider, event ID and timestamp with the incident. No matches is different from access denied or a missing log; preserve the distinction.
Step 4: Inspect cumulative CPU usage
Get-Process | Sort-Object CPU -Descending | Select-Object -First 10
CPU here is accumulated processor time since each process started. It is not a live utilization percentage; confirm a suspected spike with Performance Monitor.