0X00000428: Exception in service handling control request

Quick answer

Run sfc /scannow from an elevated command prompt, then use sc query to check the service's dependencies and fix any missing or corrupted dependencies. If that doesn't work, delete and recreate the service via the registry under HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>.

What's actually happening here

Error 0X00000428 (decimal 1064) means a service's control handler — that's the function the Service Control Manager (SCM) calls when you send a start, stop, pause, or continue request — threw an exception. The SCM doesn't handle exceptions from your service. If the service's code crashes inside that handler, the SCM gives up and returns this error.

You'll see this most often on Windows Server 2019 or Windows 10/11 after a patch Tuesday update, or when a third-party service like an antivirus driver or backup agent gets half-broken. I've also seen it on custom .NET Windows services where someone forgot to wrap the OnStop method in a try-catch.

The SCM translates the exception into NTSTATUS 0xC0000005 (access violation) or 0xC0000409 (stack buffer overflow), then maps it to ERROR_EXCEPTION_IN_SERVICE. The error code you get is a generic "something went wrong inside the service," so the fix is either repairing the service binary or cleaning up its registration.

Fix steps

1. Identify the offending service — Open Event Viewer (eventvwr.msc), go to Windows Logs > System, look for events with source Service Control Manager and ID 7034 or 7031. The message will say something like "The XYZ service terminated unexpectedly" or "The XYZ service did not respond to the start or control request." Write down the exact service name.
2. Run System File Checker — Open Command Prompt as Administrator and run sfc /scannow. This checks system files that might be shared by multiple services. If SFC finds corruption but can't fix it, run DISM /Online /Cleanup-Image /RestoreHealth first, then SFC again. The reason this works: many services rely on common DLLs like advapi32.dll or sechost.dll for the control handler infrastructure. If those are corrupt, every service crashes.
3. Check service dependencies — In the same admin command prompt, run sc qc <ServiceName> (replace <ServiceName> with the actual service name from step 1). Look at the DEPENDENCIES line. If any listed service is missing or stopped, the control handler might fail because it can't access required resources. Start each dependency with net start <DependencyName> or reinstall the dependency's software.
4. Repair the service binary — Use sc qc <ServiceName> to find the BINARY_PATH_NAME. Reinstall the application that owns this service. For built-in Windows services like WSearch (Windows Search) or Spooler, run sfc /scannow again but focus on that specific file: sfc /VERIFYFILE=C:\Windows\System32\<service-exe>. If the binary is a third-party driver or service, uninstall and reinstall the vendor's software.
5. Delete and recreate the service — If steps 1-4 fail, the service's registry entry is corrupted. Be careful here. Backup the registry first. Then open regedit, navigate to HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>, export that key as a backup. Delete the key. Then recreate the service using sc create <ServiceName> binPath= "<path-to-exe>" start= auto (adjust start type as needed). The reason deleting the registry key works: the SCM caches service configuration from the registry. A corrupted entry — like a malformed ImagePath or a missing ObjectName — causes the control handler to fail when the SCM tries to load the service's DLL.

Alternative fixes if the main ones fail

• Safe mode with networking — Boot into Safe Mode and try to start the service. If it works, a third-party driver or service is interfering. Use msconfig to disable non-Microsoft services one by one, then reboot normally.
• System Restore — If the error appeared after a software install or update, roll back to a restore point from before the change. This specifically helps when a patch changed the service control handler behavior (I've seen this with KB5005565 on Server 2019).
• Reinstall the Windows service host — For services hosted in svchost.exe (most built-in services), use DISM /Online /Cleanup-Image /RestoreHealth followed by sfc /scannow. That rebuilds the entire svchost infrastructure.

Prevention tip

When writing your own Windows service (C#, C++, or VB.NET), wrap the OnStart, OnStop, OnPause, and OnContinue methods in a try-catch block that logs the exception to the Application event log. Don't just let the exception propagate to the SCM — it gives you this cryptic error with no details. Log the actual exception message so you can fix the real bug next time.

Also, test your service on a clean VM after every major Windows update. Patch Tuesday often changes the SCM's behavior, and your service's control handler might need updating.