Services

You can use the Services Microsoft Management Console (MMC) snap-in to manage services that are running on local or remote computers — for example, to stop or start a service. You can also manage services using the sc config command.

What is a service?

A service is an application type that runs in the system background without a user interface and is similar to a UNIX daemon process. Services provide core operating system features, such as Web serving, event logging, file serving, printing, cryptography, and error reporting.

What can I do with the Services snap-in?

You can perform the following actions for services on local and remote computers (the remote computers must be running Microsoft Windows NT 4.0, Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows® 7, or Windows Server® 2008 R2):

  • Start, stop, pause, resume, or disable services.

  • Set up recovery actions to take place if a service fails — for example, restarting the service automatically or restarting the computer.

  • Run services in the security context of a user account that is different from the logged-on user or the default computer account.

  • Enable or disable services for a particular hardware profile.

  • Export and save service information to a .txt or .csv file.

  • View the status and description of each service.

  • View the service dependencies.
To start the Services snap-in

  • Click Start, in the Start Search box, type services.msc, and then press Enter.

    Note

    Membership in the local Administrators group, or equivalent, is required to use the Services snap-in.

Additional references

  • Set up Recovery Actions to Take Place When a Service Fails

  • Configure How a Service Is Started

  • Use Hardware Profiles to Troubleshoot Services

  • For more information about troubleshooting service events and errors, see http://go.microsoft.com/fwlink/?linkid=68107.

  • For information about developing and using services, see http://go.microsoft.com/fwlink/?LinkId=88931.


Set up Recovery Actions to Take Place When a Service Fails

If a service fails, you can use the Services snap-in to specify what action to take (for example, running a program or script) on the first or second service failure, or on subsequent failures.

Membership in Account Operators, Domain Admins, Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review the details in "Additional considerations" in this topic.

To set up recovery actions to take place when a service fails

  1. Click Start, in the Start Search box, type services.msc, and then press ENTER.

  2. In the details pane, right-click the service for which you want to set up recovery actions, and then click Properties.

  3. On the Recovery tab, click the action that you want in First failure, Second failure, and Subsequent failures, and then click OK.

    • If you click Run a Program, under Run program, type the full path for the specified computer. Universal Naming Convention (UNC) names are not supported. For example, type C:\scripts\handlefailure.cmd, rather than \\computername\c$\scripts\handlefailure.cmd. Programs or scripts that you specify should not require user input.

    • If you click Restart the Computer, click Restart Computer Options to specify how long the computer waits before restarting. You can also create a message to send automatically to remote users before the computer restarts.

    • Select Enable actions for stops with errors in order to trigger the recovery actions that the service stopped with an error.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, the Domain Admins group, the Enterprise Admins group, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Recovery actions are available only on computers running Windows 2000 or later.

Additional references

  • Services


Configure How a Service Is Started

Services are often run with default settings — for example, a service might be disabled automatically at startup. You can use the Services snap-in to change the default settings for a service. This is useful if you are troubleshooting service failures or if you need to change the security account under which a service runs.

Membership in Account Operators or Domain Admins, Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review the details in "Additional considerations" in this topic.

Configuring how a service is started

  • Using the Windows interface

  • Using the command line
To configure how a service is started using the Windows interface

  1. Click Start, click in the Start Search box, type services.msc, and then press ENTER.

  2. Optionally, export and save a list of the existing settings. To do this, right-click Services, select Export List, and save the settings list.

  3. In the details pane, right-click the service that you want to configure, and then click Properties.

  4. On the General tab, in Startup type, click Automatic, Manual, Disabled, or Automatic (Delayed Start).

  5. To specify the user account that the service can use to log on, click the Log On tab, and then do one of the following:

    • To specify that the service uses the Local System account, click Local System account.

    • To specify that the service uses the Local Service account, click This account, and then type NT AUTHORITY\LocalService.

    • To specify that the service uses the Network Service account, click This account, and then type NT AUTHORITY\NetworkService.

    • To specify another account, click This account, click Browse, and then specify a user account in the Select User dialog box. When you are finished, click OK.

  6. Type the password for the user account in Password and in Confirm password, and then click OK. If you select the Local Service account or Network Service account, do not type a password.

To configure how a service is started using the command line

  • You can also manage services using the sc config command. For more information about the options available, open a command prompt and type sc config /?. For examples and detailed descriptions of the command-line options, see the command-line reference at http://go.microsoft.com/fwlink/?linkid=53528.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, the Domain Admins group, the Enterprise Admins group, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Changing the default service settings might prevent key services from running correctly. It is especially important to use caution when changing the Startup Type and Log On As settings of services that are configured to start automatically.

  • In most cases, we recommend that you do not change the Allow service to interact with desktop setting. If you allow the service to interact with the desktop, any information that the service displays on the desktop will also be displayed on an interactive user's desktop. A malicious user could then take control of the service or attack it from the interactive desktop.

  • The Local Service account and Network Service account are configured with a null password. The password information you supply is ignored.

  • We recommend that user accounts that are used to log on as a service have the Password never expires check box selected in their Properties dialog box and that they have strong passwords.

  • If account lockout policy is enabled and the account is locked out, the service will not start.

  • If you enable or disable a service and you encounter a problem starting the computer, you can start the computer in Safe Mode. In Safe Mode, core services that are required to start the operating system are started in a default scheme, regardless of any changes that are made to the service settings. After the computer is in Safe Mode, you can change the service configuration or restore the default configuration.

  • If you specify an account that does not have permission to log on as a service, the Services snap-in automatically grants the appropriate permissions to that account on the computer that you are managing.

Additional references

For information about configuring the Windows Time service, see W32tm at http://go.microsoft.com/fwlink/?linkid=69453.

For more information about the user accounts that a service uses to log on, see Default Settings for Services at http://go.microsoft.com/fwlink/?linkid=68107.


Use Hardware Profiles to Troubleshoot Services

You can use the Services snap-in in conjunction with predefined hardware profiles to troubleshoot newly installed services. For example, by associating a service with two different hardware profiles (one profile in which the service is enabled and a second profile in which the service is disabled), you can more easily troubleshoot hardware problems that might occur with a newly installed service, such as a driver not loading properly.

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review the details in "Additional considerations" in this topic.

To enable or disable a service for a hardware profile

  1. Click Start, click in the Start Search box, type services.msc, and then press ENTER.

  2. In the details pane, right-click the service that you want to enable or disable, and then click Properties.

  3. On the Log On tab, click the hardware profile that you want to configure.

  4. Click Enable or Disable, and then click OK.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, the Domain Admins group, the Enterprise Admins group, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Use caution when you use this procedure to disable services. If you disable a service for a certain hardware profile, the Hardware Profile settings override the Startup type setting for that service.

  • In most cases, we recommend that you do not change the Allow service to interact with desktop setting. If you allow the service to interact with the desktop, any information that the service displays on the desktop will also be displayed on an interactive user's desktop. A malicious user could then take control of the service or attack it from the interactive desktop.

  • If you receive a Connection Manager error message when you open the Properties dialog box for a service, verify that the Remote Registry service is running on the specified computer. If the Remote Registry service is not running, or if the specified computer is running Windows NT 4.0, you cannot view or modify hardware profile settings, but you can perform any other actions.

Additional references

  • Services