COM+ Event System (EventSystem) Service Defaults in Windows XP

Default Settings

Startup type:Manual
Display name:COM+ Event System
Service name:EventSystem
Service type:share
Error control:normal
Path:%SystemRoot%\system32\svchost.exe -k netsvcs
Registry key:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventSystem

Default Behavior

COM+ Event System is a Win32 service. In Windows XP it won't start until the current user starts it. When the COM+ Event System service is started, it is running as LocalSystem in a shared process of svchost.exe. Other services and drivers are allowed to run in the same process. If the COM+ Event System fails to start, the technical information about the error is added to the Event Log. Windows XP startup should proceed, but a message box should be displayed informing the user that the EventSystem service has failed to start.


COM+ Event System depends on the Remote Procedure Call (RPC) service.

The System Event Notification depends on the COM+ Event System service.

Restore Default Startup Configuration for COM+ Event System

1. Select your Windows XP edition and service pack, and then click Download.

2. Save the WinXP_EventSystem_Service_Startup.cmd file to a local storage device.

3. Run the saved file.

4. Restart the computer.

The EventSystem service is using the es.dll file that is located in the %WinDir%\system32 folder. If the file is changed, damaged or deleted, you can restore its original version from Windows XP installation media.