Chapter 12 · Windows Services

Knowledge Check

8 min read

Try to answer before you open the answers. Guessing is fine; checking your guess is how you learn.

QUICK REVIEW (5 minutes)

  1. What is a Windows service?
  2. Which program contains the Service Control Manager, and which program starts it?
  3. Where in the registry is the service database?
  4. Name the four startup types you can choose in services.msc.
  5. What does Trigger Start mean?
  6. Which built-in account is the most powerful, and which has no network identity?
  7. What does sc sdshow show?
  8. What are the three failure "slots" in service recovery?
  9. What does error 1053 mean?
  10. What are the five states a service reports through SetServiceStatus (names only)?

ANSWER KEY — DO NOT READ UNTIL YOU'VE ANSWERED

Click to reveal answers

1. Service

A long-running background program with no user interface of its own, started, stopped and monitored by Windows through the Service Control Manager.

2. SCM

It lives inside services.exe, which is launched by wininit.exe during boot.

3. Service database

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services, with one key per service.

4. Startup types

Automatic, Automatic (Delayed Start), Manual, Disabled.

5. Trigger Start

The service is started (and may be stopped) by the SCM when a defined event happens, for example a device arrives or a network connects, instead of at boot.

6. Accounts

LocalSystem is the most powerful. LocalService presents an anonymous identity on the network (NetworkService uses the computer account).

7. sc sdshow

The service's security descriptor in SDDL form: who may query, start, stop or change it.

8. Failure slots

First failure, second failure, subsequent failures.

9. Error 1053

"The service did not respond to the start or control request in a timely fashion": the service did not connect or report back to the SCM in about 30 seconds.

10. States

START_PENDING, RUNNING, STOP_PENDING, STOPPED, PAUSED (plus the pause and continue "pending" states).

UNDERSTANDING QUESTIONS

Q1. Why do services run in session 0, away from the user's desktop?

Answer Services often run with high power. If they could show windows on a user's desktop, a normal program could send fake clicks or messages to those windows and trick the service into doing things for it. Session 0 isolation removes that path.

Q2. Why does the SCM sometimes start a service marked Manual?

Answer Manual means "not at boot, only when asked". A dependent service counts as an ask: when service A needs service B, the SCM starts B first, even if B is Manual. A trigger event can also start it.

Q3. Why is it better to run a service as LocalService than as LocalSystem?

Answer Least privilege. If the service has a bug and an attacker takes it over, the attacker gets only that account's power. LocalService is limited and anonymous on the network; LocalSystem owns the whole machine.

Q4. What is the advantage of a service SID or virtual account (NT SERVICE\<name>)?

Answer Each service gets its own identity with no password to manage. You can grant a folder to one service only, rather than to everything that runs as LocalService.

Q5. Why can sharing one svchost.exe between many services be a problem, and how did Windows 10 reduce it?

Answer If one service's DLL crashes the shared process, every service in it stops. Since Windows 10 version 1703, on PCs with enough memory (about 3.5 GB or more), most services get their own `svchost.exe`, which limits the damage.

SCENARIO QUESTIONS (Troubleshooting)

S1. You start a service and get error 1068. What do you do first?

Answer Open its Dependencies tab (or `sc qc`) and check each service it depends on. One is disabled, missing or failed. Fix the deepest broken one first, then start the original service.

S2. A custom service ran fine for months, then fails at boot with error 1069 after a policy forced a password change. Why?

Answer The service logs on as a user account whose password is saved with the service. The password changed, so the logon fails. Enter the new password on the Log On tab (or use a virtual or managed service account that has no stored password).

S3. A service you wrote works when run as a normal program, but when installed as a service it always gives 1053. What is likely wrong?

Answer It is not a true service program: it never calls `StartServiceCtrlDispatcher` to connect to the SCM within about 30 seconds. A real service must register its `ServiceMain`, set START_PENDING, then RUNNING.

S4. A web service keeps crashing every few hours. How can you keep it up while you find the cause?

Answer Set recovery actions: restart the service on the first and second failure after a short delay, and run a program that sends an alert or saves logs on later ones. Read Event Viewer entries 7031 and 7034 and the program's own log to find the real cause.

S5. A user says "Access is denied" when trying to stop a service. What does it mean and what should you check?

Answer Their account is not allowed to stop it by the service's permissions (the DACL). Most services allow only Administrators and SYSTEM to control them. Check with `sc sdshow `. Use an administrator window if it is your job, rather than changing the permissions.

INTERVIEW QUESTIONS

I1. Explain the difference between a service and a normal application.

Answer A service runs in the background without a UI, is managed by the SCM, can start at boot before any user logs in, runs under a service account and can be restarted automatically. A normal application is started by a user in their session, runs as that user and ends when closed.

I2. Describe what happens from "start service" to "running".

Answer The SCM reads the registry entry (ImagePath, Type, ObjectName, dependencies), starts dependencies, logs on the service account and creates the host process (its own exe, or `svchost.exe -k group` which loads the ServiceDll). The process calls StartServiceCtrlDispatcher, the SCM runs ServiceMain, which registers a control handler and reports START_PENDING, then RUNNING with SetServiceStatus. All within about 30 seconds.

I3. What does the -k option of svchost.exe do?

Answer It names the service group. The Svchost registry key lists which services belong to each group, and services in one group can share one svchost process. The service's own DLL is named in its `ServiceDll` value.

I4. How would you secure a third-party service?

Answer Run it under a least-privilege account (virtual account, or a dedicated user or managed account, never LocalSystem unless needed), give that account only the folders it needs, restrict who may start, stop or change it, set sensible recovery actions, protect any recovery script files, and monitor event 7045 for unexpected new services.

I5. How do you find out why a service stopped unexpectedly?

Answer Read the System event log, source Service Control Manager: 7034 or 7031 (terminated unexpectedly), 7023 or 7000 (with the error), 7009 or 7011 (timeouts). Note the time, check dependencies, account and file path, then read the application's own logs and the Application event log.

PRACTICAL TASK

Draw a "service card" for three services on your PC. Pick Print Spooler, Windows Time (W32Time) and one more of your choice. Use sc qc, sc qfailure and Get-CimInstance Win32_Service (read-only) to fill in a card for each:

FieldPrint SpoolerWindows TimeYour choice
Service name / display name
Program or svchost -k group
Startup type
Account
Depends on
Recovery actions
Own process or shared?

Why This Matters

When a service fails, these seven facts are exactly what you need to read the error and find the cause. Practising on healthy services makes broken ones much easier to diagnose.

CHAPTER SUMMARY

  • A service is a background program with no UI, run and watched by the SCM (services.exe, started by wininit.exe).
  • The service database is the registry key HKLM\SYSTEM\CurrentControlSet\Services: ImagePath, Start, Type, ObjectName, DependOnService, FailureActions.
  • Startup types: Automatic, Automatic (Delayed Start), Manual, Disabled, plus Trigger Start.
  • Dependencies make the SCM start things in a safe order; a failed dependency causes error 1068.
  • Accounts: LocalSystem, NetworkService, LocalService, virtual accounts, custom users. Use the weakest that works.
  • Permissions: a security descriptor decides who may start, stop or configure; service SIDs and hardening limit damage.
  • Recovery: first, second and later failure actions: restart, run a program, reboot.
  • Failures: errors 1053, 1058, 1068, 1069 and events 7000, 7009, 7031, 7034, 7036, 7045 are your clues.
  • Start chain: registry entry, host process (own exe or svchost), StartServiceCtrlDispatcher, ServiceMain, SetServiceStatus.