Hello JanakKhadka , Thank you for posting in Q&A forum. Do you stop the "Windows Event Log" service on DC manually and now you want to start it manually? If so, when I stop the "Windows Event Log" service manually on DC in my lab, it prompts me "Network List Service" and "Network Location Awareness" service will also stop. You can try to start "Network List Service" and "Network Location Awareness" service first, and then start "Windows Event Log" service on DC to see if you can. If it does not work, what change have you made, then "Windows Event Log" service on DC stops? You can try to undo the change you made to see if it helps. I hope the information above is helpful. If you have any questions or concerns, please feel free to let us know. Best Regards, Daisy Zhou ============================================ If the Answer is helpful, please click "Accept Answer" and upvote it.

Hello, Thank you for posting in Q&A forum. Error 1601 indicates that service controller didn't get and handle the request properly. To resolve this issue, please run "Win + R" and put in services.msc to open "Service". Check if Application Information Service is running properly, if not please start/restart it. After that please kindly restart the machine to give another and see if it works or not. Best regards， Jill Zhou If the Answer is helpful, please click "Accept Answer" and upvote it.

Why can't I restart service "Windows Event Log" in Domain Controller Server?

JanakKhadka 566

User's image

Daisy Zhou 25,451 Reputation points Microsoft Vendor

2024-07-02T12:29:40.2166667+00:00

Hello,

Good day!

How are things going? I have not heard back from you in a few days and wanted to check on the status of your problem. Please let me know the results of your troubleshooting.

Your time is greatly appreciated.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

2 answers

Daisy Zhou 25,451 Reputation points Microsoft Vendor

2024-06-26T09:21:09.31+00:00

Hello JanakKhadka,

Thank you for posting in Q&A forum.

Do you stop the "Windows Event Log" service on DC manually and now you want to start it manually? If so, when I stop the "Windows Event Log" service manually on DC in my lab, it prompts me "Network List Service" and "Network Location Awareness" service will also stop.

You can try to start "Network List Service" and "Network Location Awareness" service first, and then start "Windows Event Log" service on DC to see if you can.

If it does not work, what change have you made, then "Windows Event Log" service on DC stops? You can try to undo the change you made to see if it helps.

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Please sign in to rate this answer.
JanakKhadka 566 Reputation points

2024-06-26T09:41:45.0066667+00:00

Hello @Daisy Zhou ,

No, the services are all running. I just wanted to restart the service just to flush it without restarting the system. While trying to restart the service EventLog, it prompts me for the confirmation that all the dependent services will also start. But proceeding with the Yes, it will prompt the above attached error.
And when I try to stop the Dependant Services first, it doesn't allow me to restart the service "Network List Service".

MotoX80 34,516 Reputation points

2024-06-26T13:09:36.5266667+00:00

I just wanted to restart the service just to flush it

What specifically are you trying to flush? What is the root problem that you have? I would think that the Eventlog service is so integrated into every other service that a reboot is the only way to recycle it and have all of the other services work properly.

JanakKhadka 566 Reputation points

2024-06-27T03:53:21.49+00:00

Hello @MotoX80 ,

Our SIEM solution leverages the Microsoft Event Log to collect all logs and operates as an agentless system. Recently, it has stopped collecting logs, and the security team has requested a service restart to see if it resolves the issue. Therefore, I'm attempting to restart the services.

If it is not possible to restart this service on the Domain Controller server, could you please clarify this for me? Additionally, if there is any official documentation or confirmation regarding this, could you provide it so that I can share it with our customer?

MotoX80 34,516 Reputation points

2024-06-27T11:30:27.7066667+00:00

I think that you want to restart the Windows event collector service, Wecsvc.

https://www.windows-security.org/windows-service/windows-event-collector

https://www.csoonline.com/article/574227/how-to-enable-event-collection-in-windows-server.html
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Jing Zhou 7,340 Reputation points Microsoft Vendor

2024-06-27T05:32:52.75+00:00

Hello,

Thank you for posting in Q&A forum.

Error 1601 indicates that service controller didn't get and handle the request properly. To resolve this issue, please run "Win + R" and put in services.msc to open "Service". Check if Application Information Service is running properly, if not please start/restart it.

After that please kindly restart the machine to give another and see if it works or not.

Best regards，

Jill Zhou

If the Answer is helpful, please click "Accept Answer" and upvote it.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Why can't I restart service "Windows Event Log" in Domain Controller Server?

2 answers

Your answer