Practical Lab: Exploring Services

Objective

Look at the services running on your own PC: their names, startup types, accounts, dependencies, recovery plans and permissions. You mostly only look. Nothing in Parts 1 to 5 changes any setting.

Safety first: Do not disable, stop or reconfigure services you do not understand. If a window asks you to confirm a change, press Cancel. Part 6 is optional and is the only part that stops and starts anything.

Time: 25–30 minutes
You need: A Windows 10 or 11 PC. A normal (non-admin) window is enough for Parts 1 to 5.

What to Open

Part 1: services.msc Walkthrough

In Services, click the Extended tab at the bottom (it shows a description on the left when you select a row). Click the Name column to sort.

1. Find Print Spooler. Double-click it. On the General tab write down:
   • Service name: ________________
   • Path to executable: ________________
   • Startup type: ________________
   • Service status: ________________
2. Click Cancel (do not press Apply or Start/Stop).
3. Click the Startup Type column header to sort. How many services are Automatic? ________________ Automatic (Delayed Start)? ________________ Manual (Trigger Start)? ________________ Disabled? ________________
4. Look at the Log On As column. Write down three different accounts you see: ________________ , ________________ , ________________

Part 2: The Dependencies Tab

1. Double-click Print Spooler again and open the Dependencies tab.
2. In the top box (what it depends on), write down the items: ________________
3. In the bottom box (what depends on it), write down the items: ________________
4. Cancel. Now do the same for Remote Procedure Call (RPC). How long is the bottom box? ________________

You should find that RPC has a very long list of dependents. That is why it is vital.

Part 3: The Recovery Tab

1. Open Print Spooler and click the Recovery tab.
2. Write down:
   • First failure: ________________
   • Second failure: ________________
   • Subsequent failures: ________________
   • Reset fail count after: ________________ days
   • Restart service after: ________________ minute(s)
3. Press Cancel. Do not change anything.

Part 4: sc and PowerShell From the Command Line

In Command Prompt:

sc query Spooler
sc qc Spooler
sc qfailure Spooler

Fill in from the output:

5. STATE: ________________
6. TYPE (is it WIN32_OWN_PROCESS or WIN32_SHARE_PROCESS?): ________________
7. START_TYPE: ________________
8. DEPENDENCIES: ________________
9. SERVICE_START_NAME (the account): ________________

Now see all services that are running:

sc query type= service state= active

(The space after type= and state= is required.)

In PowerShell:

Get-Service | Group-Object Status | Select-Object Name, Count
Get-CimInstance Win32_Service -Filter "Name='Spooler'" | Select-Object Name, State, StartMode, StartName, PathName, ProcessId
Get-CimInstance Win32_Service | Group-Object StartName | Sort-Object Count -Descending | Select-Object Count, Name

10. How many services are Running? ________________ Stopped? ________________
11. Which account (StartName) has the most services? ________________
12. What is the ProcessId of Print Spooler? ________________

Part 5: Who Hosts Whom? (svchost and Permissions)

5A. Services inside processes:

tasklist /svc /fi "imagename eq svchost.exe"

13. How many svchost.exe lines are there? ________________
14. Find one svchost.exe that hosts more than one service. Write its PID and two of its services: ________________
15. Run tasklist /svc /fi "imagename eq spoolsv.exe". Which service is hosted by spoolsv.exe? ________________

5B. Task Manager. Open the Services tab (see Chapter 11). Find Spooler. Its PID should match your answer to question 12. Right-click a service and look at Go to details. Do not click Stop or Restart.

5C. The registry entry (read only). Open regedit, go to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler

Click the key and read the values on the right.

16. ImagePath: ________________
17. Start: ________________ (2 = Automatic, 3 = Manual, 4 = Disabled)
18. ObjectName: ________________

Then look at ...\Services\Dnscache\Parameters and find ServiceDll.

19. ServiceDll: ________________

Close regedit without touching anything. Never edit these values.

5D. Permissions:

sc sdshow Spooler
sc qsidtype Spooler
sc qprivs Spooler

20. In the sdshow output find (A;;...;;;BA). That line belongs to Administrators. Find the one for SY. Which letters belong to normal logged-on users (IU)? ________________

Part 6 (Optional): Event Log Review, Then a Safe Start/Stop Test

6A. Review events (read-only). In PowerShell:

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Service Control Manager'} -MaxEvents 15 | Select-Object TimeCreated, Id, Message

21. How many events are ID 7036? ________________ Do you see any 7000, 7001, 7009, 7031 or 7034 (failures)? ________________ If so, which service? ________________

In Event Viewer, go to Windows Logs → System → Filter Current Log, and choose Service Control Manager to see the same list with a window.

6B. Start/stop test (only if you feel confident). Use a harmless service. Print Spooler is a good choice only if you are not printing right now. You need an administrator PowerShell window (right-click, Run as administrator).

1. First note the current state: Get-Service Spooler. It should say Running.
2. Stop it: Stop-Service Spooler
3. Check: Get-Service Spooler (Status should be Stopped).
4. Restore it immediately: Start-Service Spooler
5. Check again: Get-Service Spooler must say Running.
6. Look in the event log (command in 6A). You should see two new 7036 events: one for stopped, one for running.

If anything goes wrong: run Start-Service Spooler again, or restart the PC. Print Spooler's startup type is normally Automatic. Never leave a service stopped that you stopped for this lab.

Do not try this on RPC, Windows Defender, the Event Log, Windows Update, networking or security services.

What Should Happen

• Parts 1 to 3 show Print Spooler's name, path, startup type, dependencies and recovery plan as the same facts you saw in Sections 2 to 7.
• Part 4 shows the same information from the command line.
• Part 5 shows services sharing svchost.exe processes and the permissions list.
• Part 6 shows that the SCM logs every start and stop.

Interpretation Guide

Follow-Up Questions

1. Which of the services you looked at shares a process with another, and which has its own? How do you know?
2. Why can a normal user open the Services list but not stop most services? (Think of Section 6.)
3. Print Spooler needs RPC. What would happen to Print Spooler if RPC stopped?
4. Why does Windows restart a crashed service only after a delay?
5. Name three facts from this lab that you could not have learned from Task Manager alone.