Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a Windows 2008 R2 Enterprise server, the event log is reporting event id 7036 "The Application Experience service entered the stopped state" and then later that it has started. This occurs approximately once an hour every day.

Based on all the documentation I can find on this service (aelookupsvc.exe) it used for 32bit / 64bit application compatibility. Lookups in Microsoft's compatibility database etc.

Is there someway I can determine what is prompting it to start and stop? I understand that as a manual service it will start/stop when needed, but I need to gather evidence as to what is causing it to start / stop.


Thank you

share|improve this question
If it helps at all the server is HP DL380 G7 running HP System Management Homepage – floyd Jun 11 '12 at 18:23
up vote 5 down vote accepted

This service starts on a trigger. In order to see what the trigger that starts this service is, you can do:

C:\Users\Ryan>sc qtriggerinfo AeLookupSvc
[SC] QueryServiceConfig2 SUCCESS


          CUSTOM         : 18f4a5fd-fd3b-40a5-8fc2-e5d261c5d02e [ETW PROVIDER UUID]

An Event Tracing for Windows event occurs and the service is triggered.

Let's look in the registry and see if we can find any more information on that UUID.

(Open images in new tab for full size.)


Looks like you could disable the event provider here, if you wanted to.

In Event Viewer, make sure "Show Analytic and Debug Logs" is enabled in the View menu, and you can see the event logs:


Some of these events have tasks attached to them, so that things happen when the events occur.


The Application Experience infrastructure does a lot of stuff. But a lot of it is probably not very important for a server. It collects telemetry information about how you are using your computer, and ships that information off to Microsoft to help them figure out how you use your PC, if you've opted in to the Customer Experience Improvement program, or whatever they call it. They diagnose common crashes and develop new patches for Windows based on that telemetry information streaming back to them from all around the world.

The Application Experience service also applies compatibility shims to applications too. Users might not have as good of a... application experience... were that service to be disabled. (For instance, maybe Outlook 2007 would crash on Win 8.1 unless this service seamlessly applied a compatibility shim when the user launched Outlook, etc. There is a huge database of compatibility shims for thousands of permutations of applications and OS versions and CPU architectures and, ... and, and...) Microsoft might notice, based on their vast amount of collected telemetry data, that a million people are suffering from an application crash and they all have some specific things in common about how their PCs are configured, what versions they're running, etc., and Microsoft may develop an update or a new compatibility shim based on that info.

Lastly, you asked not only what is prompting it to start, but also why it stops? Well the answer is simply "it stops when it has no more work to do." It goes to sleep, only to be woken up again by one of those triggers. This is completely specific to the service and it's up to the developers who wrote the service as to what logic the service uses to decide when to stop. There is probably just some logic in the service that says "if I haven't done anything useful in 1 hour, then exit."

share|improve this answer
Thank you for the great explanation! – floyd Jun 15 '15 at 18:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.