Windows Server Admin

How to Monitor a Windows Service and Get an Email Alert When It Stops

Updated August 2026 · 6 min read

A stopped Windows service is one of the most common causes of "silent" downtime — the server is up, ping responds fine, but the application depending on that service is dead. Whether it's a print spooler, a custom background job, or a database engine, the earlier you know it stopped, the less damage it does.

There are two practical ways to get an email the moment a service stops: build it yourself with Task Scheduler and PowerShell, or use a small tool that already does this out of the box. Both are covered below.

Method 1: Task Scheduler + PowerShell (free, DIY)

Windows can trigger a script whenever a specific service changes state, using the built-in Service Control Manager event log.

  1. Open Event Viewer → Windows Logs → System, and find a recent Service Control Manager event (Event ID 7036) for the service you care about.
  2. Right-click the event → Attach Task To This Event.
  3. In the wizard, set the action to Start a Program, pointing to powershell.exe with an argument that sends an email.

A minimal PowerShell email sender looks like this:

Send-MailMessage -From "[email protected]" `
  -To "[email protected]" `
  -Subject "Service stopped on $env:COMPUTERNAME" `
  -Body "A monitored service changed state. Check the server." `
  -SmtpServer "smtp.yourdomain.com" -Port 587 -UseSsl `
  -Credential (Get-Credential)

This works, but it has real limitations: it only fires on state changes captured by that specific event, it needs to be set up per-service and per-server, credentials for SMTP need to be stored securely, and there's no re-check logic — a single flaky log entry can trigger a false alarm at 3am.

Method 2: A small monitoring tool

If you're watching more than one or two services — or more than one server — a dedicated tool ends up being less work than maintaining scheduled tasks across every machine. The tool needs to do three things well: check services (and ideally ping, disk, CPU, and RAM too) on a schedule, double-check before alerting so a one-off blip doesn't wake you up, and send a proper HTML email through your own SMTP server without a third-party relay.

AITMonitor does this out of the box

AITMonitor watches Windows services, ping, disk, CPU, and RAM across as many servers as you add, and emails you through your own SMTP server the moment something fails — with double-check logic built in so transient blips don't cause false alarms. No agent to install on the monitored servers; it uses WMI, which is already built into Windows.

Free forever for up to 5 servers, no credit card required.

See AITMonitor →

Which one should you use?

If you only need to watch one service on one server and don't mind maintaining a script, the Task Scheduler approach costs nothing and works fine. Once you're watching several services across more than one server, the maintenance overhead of scheduled tasks per-machine usually outweighs the five minutes it takes to set up a small monitoring tool that handles it centrally.