I'm reviewing the logs of a Windows Server 2008 R2 server which is running inside a VM. The server hosts an Azure web role. The logs contain this record:
The Plug and Play service entered the running state
This is completely unattended server hosted inside a VM.
Why would it need this service in the first place?
Among other things you need this service to enumerate both new and, at boot time, existing hardware.
According to this Wikipedia's article the Plug and Play Service implements the bulk of the work done by the Plug and Play Manager. The PnP Manager is responsible for hardware detection and resource management, including boot-time detection:
Further, during system startup the PnP Manager loads the file system drivers and drivers marked
SERVICE_BOOT_START
as described in the MSDN article What Happens to File Systems During System Boot:For these reasons and more it's appropriately stated in the service's description Stopping or disabling this service will result in system instability.
For a start there are several services that depend upon the Plug and Play Service:
Perhaps one of these services needed to start?
The Plug and Play service is an integral part of windows 7 / 08, if you are really interested to know why it exists, what it does and what may cause it to stop and start, then you could do worse than to obtain and read Windows Internals by Mark Russinovich.
TL;DR - Since you don't know what this service does, or how it relates to the OS as a whole, it's probably best if you don't speculate about whether or not it should be running.