# Winlogbeat service won't start - Server 2016
**URL:** https://discuss.elastic.co/t/winlogbeat-service-wont-start-server-2016/211374
**Category:** Beats
**Created:** [December 10, 2019, 8:47pm UTC](https://discuss.elastic.co/t/winlogbeat-service-wont-start-server-2016/211374 "2019-12-10T20:47:28Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@uklipse](https://discuss.elastic.co/u/uklipse)
#### Post date: [December 10, 2019, 8:47pm UTC](https://discuss.elastic.co/t/winlogbeat-service-wont-start-server-2016/211374/1 "2019-12-10T20:47:28Z")
I'm trying to install winlogbeat on a Server 2016 host but the service won't start. I've tested the config file using: winlogbeat.exe test config and it comes back OK. I've tried running it in the foreground using winlogbeat.exe -c winlogbeat.yml -e -v -d "\*" and get some results in Kibana. The same install files are used on Win10 machines and they install and services starts correctly. We use an older version of winlogbeat but I've downloaded the newest one (7.5) and get the same result of service not starting.
Anything else I can try or is there something different with Server 2016?
---
### Author:  [@Michal\_Pristas](https://discuss.elastic.co/u/Michal_Pristas)
#### Post date: [December 11, 2019, 3:05pm UTC](https://discuss.elastic.co/t/winlogbeat-service-wont-start-server-2016/211374/2 "2019-12-11T15:05:22Z")
hey @uklipse
can you see some error in the event log?
---
### Author:  [@uklipse](https://discuss.elastic.co/u/uklipse)
#### Post date: [December 11, 2019, 3:52pm UTC](https://discuss.elastic.co/t/winlogbeat-service-wont-start-server-2016/211374/3 "2019-12-11T15:52:23Z")
The only error I get is: The winlogbeat service terminated unexpectedly. It has done this 3 time(s).
Not very helpful
---
### Author:  [@Michal\_Pristas](https://discuss.elastic.co/u/Michal_Pristas)
#### Post date: [December 11, 2019, 3:57pm UTC](https://discuss.elastic.co/t/winlogbeat-service-wont-start-server-2016/211374/4 "2019-12-11T15:57:01Z")
and what about winlogbeat logs directory?
I assume you ran `.\install-service-winlogbeat.ps1` script
can you also share a path where winlogbeat is located?
---
### Author:  [@uklipse](https://discuss.elastic.co/u/uklipse)
#### Post date: [December 11, 2019, 4:16pm UTC](https://discuss.elastic.co/t/winlogbeat-service-wont-start-server-2016/211374/5 "2019-12-11T16:16:16Z")
Yes I extracted the 7.5 download file to the Downloads folder and ran the install-service-winlogbeat.ps1 script. The full path is C:\Users\demoadmin\Downloads\winlogbeat-7.5.0-windows-x86\_64\winlogbeat-7.5.0-windows-x86\_64
---
### Author:  [@Michal\_Pristas](https://discuss.elastic.co/u/Michal_Pristas)
#### Post date: [December 11, 2019, 4:18pm UTC](https://discuss.elastic.co/t/winlogbeat-service-wont-start-server-2016/211374/6 "2019-12-11T16:18:10Z")
I think windows service tries to locate your service on a path `C:\Program Files\Winlogbeat\...`
try renaming winlogbeat-7.5.0-windows-x86\_64 to `Winlogbeat` as stated here: [https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation.html)
---
### Author:  [@uklipse](https://discuss.elastic.co/u/uklipse)
#### Post date: [December 11, 2019, 4:31pm UTC](https://discuss.elastic.co/t/winlogbeat-service-wont-start-server-2016/211374/7 "2019-12-11T16:31:24Z")
Tried that but same result of service not starting. Our original installation had this in the C:\Program Files. I was just using the download folder by keeping everything to default settings.
---
### Author:  [@Michal\_Pristas](https://discuss.elastic.co/u/Michal_Pristas)
#### Post date: [December 12, 2019, 10:22am UTC](https://discuss.elastic.co/t/winlogbeat-service-wont-start-server-2016/211374/8 "2019-12-12T10:22:36Z")
for me it seems like windows has some issues finding service as you don't see any winlogbeat logs.
can you run `services` and find winlogbeat there? if you select properties you will see `Path to executable` settings. Make sure this path and the path where your installation lives matches.
---
### Author:  [@uklipse](https://discuss.elastic.co/u/uklipse)
#### Post date: [December 12, 2019, 4:42pm UTC](https://discuss.elastic.co/t/winlogbeat-service-wont-start-server-2016/211374/9 "2019-12-12T16:42:46Z")
I'm not sure that this is a winlogbeat issue now but a Windows one. I rebooted the computer and the service was running however after a few minutes it stopped and wouldn't restart. During that time I did receive logs from it.
---
### Author:  [@uklipse](https://discuss.elastic.co/u/uklipse)
#### Post date: [January 2, 2020, 8:15pm UTC](https://discuss.elastic.co/t/winlogbeat-service-wont-start-server-2016/211374/10 "2020-01-02T20:15:22Z")
I'm still having this issue but wanted to update with what I've found. The winlogbeat service only starts on a reboot and is stable until the service is restarted. After a restart attempt, we get an Error 1067: The process terminated unexpectedly. I thought this might be a Windows issues so I posted this over in the Microsoft forums but they ultimately said to check with the developer.
So I'm not sure why it starts on a reboot but not just a regular restart.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 5, 2020, 3:24pm UTC](https://discuss.elastic.co/t/winlogbeat-service-wont-start-server-2016/211374/12 "2020-02-05T15:24:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.