.      How to articles       Windows Services       Group Policy             Donate        
Computer step by step
Services Regedit CMD Msconfig

How to Start/Stop Windows Event Collector service

Service name: Wecsvc

Display name: Windows Event Collector


Description:

This service manages persistent subscriptions to events from remote sources that support WS-Management protocol. This includes
Windows Vista event logs, hardware and IPMI-enabled event sources. The service stores forwarded events in a local Event Log. If this
service is stopped or disabled event subscriptions cannot be created and forwarded events cannot be accepted.


Path to executable:

C:\Windows\system32\svchost.exe -k NetworkService

CMD:
This method shows you how to Start/Stop Windows Event Collector service from Command Prompt

Please perform the following steps:

Please go to Start and click on the Search programs and files

Type cmd, right click on cmd icon under the Programs and click on Run as administrator

Please confirm User Account Control pop-up

Please select, right and copy a registry key from below, then right click on command prompt window, select Paste and press Enter


To Start Windows Event Collector service:

net start Wecsvc


Note: You can’t start a service if Startup type is on Disabled.


To Stop Windows Event Collector service:

net stop Wecsvc


To change Startup type:

Automatic:

REG add "HKLM\SYSTEM\CurrentControlSet\services\Wecsvc" /v Start /t REG_DWORD /d 2 /f

Manual:

REG add "HKLM\SYSTEM\CurrentControlSet\services\Wecsvc" /v Start /t REG_DWORD /d 3 /f

Disabled:

REG add "HKLM\SYSTEM\CurrentControlSet\services\Wecsvc" /v Start /t REG_DWORD /d 4 /f

Automatic (Delayed Start):

REG add "HKLM\SYSTEM\CurrentControlSet\services\Wecsvc" /v Start /t REG_DWORD /d 2 /f


Note: When you change to Automatic (Delayed Start) a new key DelayedAutostart is created with value 1.

REG add "HKLM\SYSTEM\CurrentControlSet\services\Wecsvc" /v DelayedAutostart /t REG_DWORD /d 1 /f


When you change to Automatic from Automatic (Delayed Start), DelayedAutostart change value to 0.

REG add "HKLM\SYSTEM\CurrentControlSet\services\Wecsvc" /v DelayedAutostart /t REG_DWORD /d 0 /f

                                                                                 Services List