Section 3: Service Startup Types

The Big Picture: When Does the Worker Clock In?

Not every worker in a hotel starts at midnight. The night guard starts at once. The pool cleaner starts after breakfast. The party planner only comes when there is a party. Some staff are told never to come at all.

A service's startup type is its clock-in rule. It answers: "When should the SCM start this service?"

Two more values you may meet: 0 (Boot) and 1 (System) are used by drivers that load very early. Normal services use 2, 3 or 4.

You can see the startup type in services.msc (the Startup Type column) or in PowerShell:

Get-CimInstance Win32_Service | Select-Object Name, StartMode, State | Sort-Object StartMode | Select-Object -First 15

3.1 Automatic

What it is: The SCM starts the service during boot, without waiting for anyone to log in.

Use for: things the PC needs all the time, such as the Event Log, the firewall, the network stack helpers and the Plug and Play service.

Boot ─► kernel ─► smss.exe ─► wininit.exe ─► services.exe
                                              │
                                              ▼
                              starts all "Automatic" services
                              (obeying their dependencies, Section 4)

The trade-off. Every Automatic service adds a little work to boot. Too many make start-up slow, and each one uses memory while running. That is why Microsoft created the next type.

Real-world analogy: the night guard who is already at the door when the hotel wakes up.

3.2 Automatic (Delayed Start)

What it is: Same as Automatic, but the SCM waits until the main boot work is done and then starts these services. In practice it is about a couple of minutes after the system is up. The exact delay is not fixed and can be adjusted by Windows.

Why it exists. At boot the disk and CPU are busy. If every service jumped in at once, the desktop would take longer to appear. Delayed services let the important parts finish first, so you get a usable desktop sooner. Windows also starts them one by one at a lower priority so they do not slow you down.

How it is stored. The registry value Start stays 2, and an extra value DelayedAutostart is 1. So tools show "Automatic (Delayed Start)".

Typical examples: background helpers such as update, maintenance and sync jobs that are not needed to log in. Exact choices vary by Windows version, so look at the Startup Type column on your own PC.

Rule of thumb for IT people: if a service is not needed to reach the desktop, delayed start is often a better choice than plain Automatic.

Real-world analogy: the pool cleaner who starts once breakfast is over.

3.3 Manual

What it is: The service does not start at boot. It starts only when someone or something asks (you, or another program or service that needs it).

Why many services are Manual. A service that is rarely needed should not use memory all day. Windows starts it when it is wanted. The SCM can also start a Manual service automatically when another service that depends on it starts (Section 4).

Examples: services for rarely used features, such as certain Bluetooth, remote-access or smart-card helpers.

Start one by hand (needs an administrator):

sc start <ServiceName>

or in PowerShell: Start-Service <ServiceName>.

Important: "Manual" means "started on request", not "only started by a human". Windows often asks for it for you.

Real-world analogy: the maintenance worker you call only when something breaks.

3.4 Disabled

What it is: The service cannot be started at all. Even if a program asks for it, the SCM refuses. You will see error 1058, which says the service cannot be started because it is disabled (or has no enabled devices linked to it).

Why use it. To make sure a feature stays off. Examples: switching off a service you really do not need, or a company policy that blocks a feature.

The dangers:

Warning: Do not disable a service you do not fully understand. "Tweak guides" on the internet often tell people to disable dozens of services to "speed up" the PC. On modern hardware this rarely helps and often breaks things. If you must test, change one service, note its original startup type, and be ready to put it back.

Putting a service back (administrator command prompt; example only, use the original value you wrote down):

sc config <ServiceName> start= auto

Allowed words: auto, delayed-auto, demand (Manual), disabled. Again, mind the space after start=.

Real-world analogy: a worker whose pass has been taken away. The door will not open for them.

3.5 Trigger Start

What it is: A trigger-start service starts (and sometimes stops) when a specific event happens, instead of at boot. Windows added this in Windows 7.

Triggers can be things like:

How it works. The service is stored with startup type Manual, plus a list of triggers. The SCM watches for the events. When one happens, the SCM starts the service. When the opposite event happens (for example the device is removed), the SCM can stop it again.

    Event happens (e.g. USB device plugged in)
                    │
                    ▼
        SCM sees it matches a trigger
                    │
                    ▼
           starts the service  ──► service does its job
                    │
         opposite event (device removed)
                    ▼
            SCM stops the service again

Why it is great. It saves memory and power: no program sits waiting for something that might never happen. It also makes boot faster.

See the triggers. Run in a normal command prompt:

sc qtriggerinfo <ServiceName>

If the service has none, it says so. In services.msc, trigger-start services show a startup type like Manual (Trigger Start). In the registry look under ...\Services\<name>\Triggers.

Real-world analogy: the party planner who is called in only when a party is booked and sent home after.

Summary

Golden rule: Leave Microsoft's default startup types alone unless you have a clear reason.