Is there an event log entry that can tell you what the Device Association Service is getting stuck on?

Hi BlackJacques!

Thanks for reaching out to the community!

Great question — unfortunately, there is no single, clear event log entry that will directly say “Device Association Service is stuck on Windows.” However, you can correlate event logs and system behavior to identify which device, driver, or event is causing the issue.

Here’s how you can effectively trace what DAS is getting stuck on, and what event logs will help:

Step-by-Step: How to Use Event Logs to Trace DAS Problems

1. Start with the Event Viewer → System Logs

Go to:

Event Viewer → Windows Logs → System

Look for entries with:

Source: Service Control Manager, DeviceSetupManager, UserPnp, Kernel-PnP, dasHost

Event IDs: 20001–20004, 400, 1000, 7031, 7034, 10005

These will tell you:

When a device was plugged/unplugged

When DAS crashed or restarted

If there were delays in device initialization

2. Event Viewer → Applications and Services Logs → Microsoft → Windows → DeviceSetupManager → Admin

This is a dedicated log for device association and installation. It’s not always enabled, but when it is, it logs pairing attempts, driver downloads, timeouts, and failures.

Look for entries like:

"Device install requested for [DeviceInstanceId]"

"Association started for device..."

"Failed to complete device installation"

"Timed out waiting for device..."

These entries often contain the hardware ID or device name, letting you trace which one is stalling.

3. Enable Verbose Plug and Play Logging (Optional but Very Helpful)

To get more detailed info:

Enable via Registry:

reg

Copy

Edit

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\LogLevel]

"LogLevel"=dword:0002000F

This enables verbose device installation logging — helpful if normal logs are too vague.

4. Look for Patterns: DAS High CPU → Event Viewer Timestamps

When you see DAS spike to 100% CPU:

Open Task Manager or Process Explorer

Note the exact timestamp

Go to Event Viewer, and look for any events in the 30 seconds prior

Device reconnects

Driver warnings

Power or USB controller events

These are often silent hardware re-pair attempts or buggy drivers retrying communication.

5. Use Process Explorer to Find What DAS Is Actually Doing

Since DAS runs inside svchost.exe, you can:

Open Process Explorer (from Microsoft Sysinternals)

Find the svchost.exe instance hosting DeviceAssociationService

Hover to confirm the service

Right-click → Properties → Threads

Look for threads using high CPU

Note the start address and DLL/module name

If it's stuck in a vendor driver (e.g., RealtekBT.dll or UsbAudio2.sys), that’s your culprit.

Hope it helps your concern. If not let me know.

Regards,

Aeron C.

Independent Advisor

Okay, I've attempted to stop DAS from starting in services before, and Windows does not allow you to change this status under any circumstances. You can reboot, and you'll find that DAS has been started just the same after the reboot.

Hi BlackJacques!

Good Day! when Device Association Service (DAS) gets stuck and maxes out all CPU cores, your system may freeze so badly that event logs don’t get written. In that case:

What You Can Do:

1. Record a performance trace using [Windows Performance Recorder (WPR)] — it works even under heavy CPU load. Later, open it with WPA to see what’s eating the CPU.
2. Temporarily disable DAS via services.msc and reboot — if the problem stops, DAS is the cause.
3. Clear device metadata cache at: %ProgramData%\Microsoft\Windows\DeviceMetadataCache
4. Boot into Safe Mode — if the problem goes away, it's likely a bad driver or device.
5. Set up a crash dump and trigger a BSOD to capture a memory dump for deep analysis if needed.

I marked it as resolved on my end but you can always reach out to the community for future concerns.

Thanks,

Aeron C.

Yes, thank you, I'll try those suggestions. Since there's no guarantee when the next event will occur, I'll just mark this as the answer.

One further question, when DAS stuck, it uses up every possible thread and core on the system at the same time. The system hardly responds during that time. I have my doubts that even the event log is working much during that time. What can be done if there's no entries in the event log?