Service failed to start because a dependent service is stopped.
Cascade of service failures may indicate an attacker stopped a foundational service. Monitor for chains of 7001 events following 7036 (service stopped).
Correlate with 7036 to identify root cause service stop.
param1param2Computer Starting points — adapt the log source, projected fields and thresholds for your environment.
Event
| where EventLog == "System" and EventID == 7001 // The service depends on another service
// EventData holds: param1, param2, Computer
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:System" EventCode=7001
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# The service depends on another service — add EventData fields: param1, param2, Computer`The service depends on another service. Service failed to start because a dependent service is stopped.
Event 7001 is written to the System channel by Service Control Manager / Kernel. Logged by default in the System channel; no audit policy required.
Correlate with 7036 to identify root cause service stop.