Event ID 10009 — Application and Service Detection Status

Applies To: Windows Server 2008 R2

Restart Manager attempts to detect applications and services that are using resources needed for program installation or updates. If this detection process is successful, event 10005 is logged and the event details contain a list of the applications and services using the required resources. This indicates that Restart Manager succesfully detected resource requirements, but that a system restart might be required to complete the operation.

Restart Manager uses service tagging to identify services that are using required resources. Services are supported by a service host process, which appears in Task Manager and other process lists as svchost. If this operation is successful, only the services that are using required resources are stopped. If this operation is not successful, and if the service host process does not also support critical system services, the entire service host process is stopped and event ID 10009 is written to the Event Log.

Event Details

Product: Windows Operating System
ID: 10009
Source: Microsoft-Windows-RestartManager
Version: 6.1
Message: Service tagging failed to find target service in process %2.


No user action is required.

No user action is required. Restart Manager will attempt resolve the issue the next time it runs.


Restart Manager is used by installation and update programs. To verify that the installation or upgrade process was successful, review the Event Log after a system restart or after the completion of the installatin or upgrade process. If event ID 10009 does not appear, the detection process was successful.

Application and Service Detection Status

Reliability Infrastructure