---
title: "Using Windows Services to Activate Triggers"
slug: "using-windows-services-to-activate-triggers"
description: "Use Service Monitoring to create triggers that activate based on the state of a Windows service."
tags: ["Windows Service", "Service Monitoring", "Service Trigger", "Trigger Service ", "Automated Action Services"]
updated: 2025-07-02T18:36:43Z
published: 2025-07-02T18:36:43Z
canonical: "support.controlup.com/using-windows-services-to-activate-triggers"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.controlup.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Using Windows Services to Activate Triggers

You can configure a trigger to activate when the status of a Windows service changes to **Stopped** or **Not Configured**. The status **Not Configured** means that the service does not exist on the machine. From version 9.0.5, you can [configure triggers with PowerShell cmdlets](/v1/docs/powershell-cmdlets-for-triggers).

## Prerequisites

- ControlUp Agent installed on the target machine

## Step 1 - Add Services to Monitor

Before you create a trigger based on a Windows service, you must add the service to your list of monitored services. If a service is not in this list, then you can't use that service in a trigger.

**To add a service:**

1. In the Real-Time DX Console, go to **Settings > Service Monitoring**.

![Service Monitoring pane.](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/image-6FHOEBU0.png)
2. Click **Add** and enter the display name of the service that you want to use in a trigger.

**Service name vs. service display name**

The **service name** is different than the service **display name**. You need to enter the **display name**.

![Print Spooler properties window displayed with Service name and Display name lines.](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/ServiceDisplayName.png)

## Step 2 - Create a Trigger

After adding a Windows service in the **Service Monitoring** settings, you can select the service when you configure a trigger.

1. Create an **Advanced** trigger type and set the record type to **Service**.

![Advanced trigger with service record type selected.](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/ServiceRecordType.png)
2. Use the filter editor to set the Windows service and status that causes the trigger to activate. In this example, the trigger activates when the **Print Spooler** service is stopped on a machine.

![Filter editor window with From this state and To this state boxes displayed.](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/ServiceTriggerExample.png)

For more details on creating a trigger, visit [Setting up Triggers](/tim-reorg/docs/setting-up-triggers).

## Use Case Example - Send a Webhook When A Service Stops Running

To use a webhook or an email notification as a trigger follow-up action, you need to create a [notification template](/tim-reorg/docs/notification-templates). Three new variables have been added to use for services:

- $(servicename)
- $(servicestatus)
- $(servicecompname)

In this example, we create a trigger that activates when the Print Spooler service stops running. ![Filter editor window with And Service Status is Stopped configured.](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/image-MIGEKJ84.png)

For the trigger follow-up action, we configure a [webhook follow-up action](/tim-reorg/docs/using-webhooks-as-follow-up-action) and use this notification template:

```plaintext
{
  "Organization Name": "$(OrgName)",
  "Folder Name": "$(CUFolderName)",
  "Reported By": "$(ReportedBy)",
  "Trigger Name": "$(TriggerName)",
  "Computer Name": "$(CompName)",
  "Service Name": "$(servicename)",
  "Service State": "$(servicestatus)",
  "Service Computer Name": "$(servicecompname)",
  "Resource Type": "$(ResourceType)",
  "Stress Level": "Advanced",
  "Incident Timestamp": "$(Timestamp)",
}
```

When the Print Spooler service stops running on a machine, the trigger activates and sends the following webhook: ![Raw Content popup displayed with script.](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/image-DP87XQB7.png)