Error 1079, Windows Time, Windows Event Log, Windows Firewall services fail to start

If you find that one or more of the following specified services, i.e., Windows Time, Windows Event Log, Windows Firewall services, fail to start, with Error 1079, on your computer running Windows 11/10 or Windows Server. In that case, this article may interest you.

The services in question are:

• Windows Time  (W32Time)
• Windows Event Log  (eventlog)
• Windows Firewall  (MpsSvc)

Windows Time, Event Log, Firewall services fail to start

Every service, every process in Windows 10 has an account associated with it. For Services, it is a Local Service account. These accounts are used to manage system applications on the OS. It may so happen that the services we mentioned above are being managed by the Local System account instead of the Local Service account (NT AUTHORITY\LocalService).

It fails because the Local System account doesn’t have sufficient permissions to start the service.

Error 1079, The account specified for this service is different

Moreover,  when you try to start the service/s manually, you may receive the following error message:

Error 1079: The account specified for this service is different from the account specified for other services running in the same process.

In such a case, KB2478117 recommends that you ensure that the service is being started by the Local System account instead of by the Local Service account (NT AUTHORITY\LocalService).

To do so, type services.msc in start search and hit Enter to open Windows Services.

Here is how to change the user for Windows Time Service:

1. Locate and double-click on Windows Time service.
2. Switch to the Log On tab
3. It should be set to Local System account because of which it is failing.
4. Switch to This account, and then type “NT AUTHORITY\LocalService”
5. You can also click on Browse > Advanced > Find Now and locate the Local Service user account.
6. Leave both the Password fields blank.
7. Click Apply and then OK.

To change it for the Firewall Service, scroll down to the service in question, say, Windows Firewall service, and double click on it to open its Properties box.

Click Log On tab, and under This account, type NT AUTHORITY\LocalService. You may set both Password fields blank.

Click Apply/OK.

In the case of Windows Firewall service, repeat this step for the Base Filtering Engine service, too, as BFE is a service that manages firewall and Internet Protocol security.

Similarly, do so for the Event Log Service.

Now you will be able to start the Services.

What is Group Policy Event ID 1079?

Group Policy Event ID 1079 indicates a failure in processing Group Policy. This error means that Windows could not retrieve the list of Group Policy objects for the computer or user. Common causes include network connectivity issues or permission problems. Troubleshooting steps involve checking the network connection and ensuring correct permissions are set.

How do you set any service/dependent services to run under the NT Authority Local Service account?

Change the Log On settings of any service property. Open the Services panel, right-click on any service, and select Properties. Then switch to the Log On tab and select the This account radio button. Then click on the Browse button and select the NT Authority Local Service account button. Apply the changes. Next time the service starts, it will run under the NT Authority Local Service account.