-
What is a Windows Service?
A Windows Service is an advanced component/feature of Microsoft Windows that supports the management of long running, background processes and applications.
Unlike regular programs that are started by a user and run only while that user is logged on, a Windows Service application can start before any user logs on and
can continue to run even after all users have logged off.
Windows Services are ideal for software that must started when the PC boots. A Windows Service is conceptually similar to a UNIX daemon.
-
How do I manage a Windows Service?
Windows Services can be managed using the Windows Services control panel applet. To start the applet, either:
- Choose Start > Control Panel > Administrative Tools > Services; or
- Run "services.msc" from Start > Run...
The applet lists the Windows Services installed on the PC:
Double-click an entry to reveal its specific properties:
You can start, stop, pause or resume the service as appropriate.
You can also modify the settings, such as the startup type (Automatic or Manual) or the log on account (on the Log On tab), etc.
-
How do I start/stop a Windows Service from the command line?
You can use the NET command to start and stop any Windows Service from a DOS prompt.
To start a service named "MyService", you would execute:
NET START MyService
To stop the same service, run:
NET STOP MyService
Be sure to enclose the service name in quotes if it contains spaces.
Note that only users with administrative privileges will be able to run the NET command. Watch out for UAC on Windows 7, Vista and Server 2008!
-
How do I remove/delete a Windows Service?
A Service can be deleted using the venerable
SC command.
Use it like this to remove a service called "MyService":
SC delete MyService
Enclose the service name in quotes if it contains spaces.
Beware: You can do serious damage to your operating system if you delete a critical service. Procced with caution!
-
How do I prevent a Windows Service from running?
Most services are set to start automatically when Windows boots. These will show up with a Startup type of Automatic (or Automatic (Delayed Start) in Windows Vista, 7, 2008)
in the Services Control Panel Applet:
If starting at boot is not acceptable, you can change the Startup type to one of the following:
- Manual - The service should only start on demand, when explicitly requested to do so by a user (or by an application).
This is the appropriate choice when you want to start and stop the service yourself.
- Disabled - The service can not be started by any user or program. Choose this option to totally disallow the service from running.
Be sure not to disable any important Windows Service!
Of course, deleting a service is another way to prevent it from running but that is only recommended if you know what you are doing and can take full responsibility for the consequences!
-
My Service is stuck in the "Stop Pending" (or "Start Pending") state. How do I stop it?
A pending state usually means one of two things. Either:
- the service is working normally and is just taking a long time to complete a necessary operation, or
- the service has hung and is not interacting normally with the Windows Services Control Manager.
If you have waited long enough to rule out the first situation, then we have the second, and the only way to stop the service is to reboot the machine or terminate its underlying process.
To terminate the process:
-
Find the process identifier (PID) of the Service's process using the SC command. For a Service named MyService, run:
sc queryex MyService
(Be sure to enclose the service name in quotes if it contains spaces.)
Here is the result for the UI0Detect Service:
Make a note of the number on the PID line (4388 in the screenshot above).
-
Run the taskkill command to forcibly terminate the process. For PID 4338, use:
taskkill /F /T /PID 4388
You should see a SUCCESS message if all went well:
If you get "Access Denied", please ensure that you have the necessary administrative priveliges by running the Command Prompt as an Administrator.
(Darn UAC!)
-
My Windows Service fails to start (or stops working unexpectedly). How do I figure out what is wrong?
Most Windows Services report information, warnings and errors to the Windows Event Logs, so start there.
You can review those messages using the
Windows Event Viewer
Control panel application.
Windows Services will place their messages in the Windows Logs > Application section (on the left hand side). The Source column in the central window contains the name of the service reporting the event.
Here is an information event reported by the Avira AntiVir service:
When a Service encounters a problem and can not create a log entry, the Service Control Manager (SCM) will write an entry in the Windows Logs > System section.
For exmple, here is the SCM telling us why the ActiveBooks service failed to start:
Hopefully the Event Log messages will shed some light on what is going wrong!
-
My application works when I run it normally but it fails when started from a Windows Service. What is the problem?
You probably need to specify an account that can run the application normally on the service's Log On tab:
By default, your service is run in the LocalSystem account which may be very different from the account that you log in to. Your application will encounter trouble if it:
- Uses a printer or a network drive and LocalSystem does not have sufficient rights to use those devices
- Has never been installed in the LocalSystem account and so can not find its settings there
- Needs to access registry values or environment variables in your "normal" account
Specifying your normal account on the Log On tab should solve those kind of problems. Note that your service won't be able to "interact with the desktop" though.
-
What changed in Windows Vista (2006)?
Microsoft made significant adjustments to Windows Services in Vista. The main changes are:
-
Session 0 is now "isolated" and no user can log in there to interact with the GUI from a Service. This change - effected primarily for security concerns - makes it
much more difficult to work with GUI-based Windows Services. The situation is extensively discussed in the
"Can a Windows Service have a GUI?" entry.
-
In an attempt to reduce resource contention as the computer boots, services that should be started at boot now have the option of being delayed and starting shortly after boot.
In practice, this means delaying service startup by 1-2 minutes - quite appropriate for some services.
The new setting is available in the Startup type field - Automatic (Delayed Start):
The complete technical details are available in
this article from Microsoft Developer's Network.
-
How do I switch to Session 0 from the Command Line?
You can switch to Session 0 from the command line by running:
rundll32.exe winsta.dll,WinStationSwitchToServicesSession
Save one of these files to your desktop to easily access Session 0 on demand:
Note that the Interactive Services Detection service (UI0Detect) must be running for switching to work!
-
What changed in Windows Server 2008?
Nothing. No new features were introduced in the original release of Windows Server 2008.
There were a few changes for Server 2008 R2 though.
-
What changed in Windows 7 and Windows Server 2008 R2 (2009)?
The adjustments made in 2009 were highly technical and not very visible to end users. Only the following is of note:
The complete technical details are available in
this article from Microsoft Developer's Network.
-
What is Session 0 Isolation?
A Session (also known as a Logon Session) is created whenever a user logs in to Windows. Each session has a numeric identifier,
called a Session ID.
Windows creates a single session when your PC boots and all the Windows Services (and many other administrative processes) will run in that session. Since the ID of that session is 0, it has been
nicknamed Session 0.
On Windows NT, 2000, XP and Server 2003, the first user to log into the physical PC is automatically placed into the already created Session 0.
A RDP/Terminal Services user can log in to Session 0 by specifying a special flag when opening the connection (/admin).
And once in Session 0, a user can see and interact with the graphical elements of any program running there, including those created by Windows Services.
In this way, Microsoft (perhaps inadvertently?) allowed users to freely interact with Windows Services that choose to display a user interface.
Ultimately, Microsoft decided that easily allowing users to interact with service applications could lead to security problems.
Indeed, a virus installing itself as a service running from a high privelege account could wreak havok on a user's desktop!
Microsoft's solution is to prohibit users from logging in to Session 0. The first user creates Session 1, the second Session 2, etc., and there is simply no way to access Session 0 directly.
This policy, introduced in Windows Vista in 2006, became known as Session 0 Isolation. It is described in great detail in
this technical document from Microsoft.
Session 0 Isolation is enforced in all newer versions of Windows, namely Windows 7, Vista, Server 2008 and Server 2008 R2.
It is NOT a feature of Windows NT, 2000, XP and Server 2003 and Microsoft has no plans to retrofit those older operating systems.
-
What is Srvany?
Srvany is a utility developed by Microsoft that can start almost any regular, non-service application as a Windows Service.
Since a Windows Service must be specially constructed to interface with the operating system (to allow Windows to start, stop or pause it on demand),
a regular application without this interface will not function properly as a Service.
To solve the problem, Microsoft developed Srvany - an "adapter" (or "wrapper") that can accept the Windows Service commands and translate those into
actions that a regular executable can understand.
Like any good adapter, Srvany is installed in between Windows and the application and handles all interaction between them.
For example, when Windows says "Start the service", Srvany intercepts the request
and starts the application as if you had double-clicked on it yourself.
Srvany was developed in the late 1990's for Windows NT and remains mostly unchanged to this day. It is available as part of the
Windows Server 2003 Resource Kit Tools package.
-
What is Instsrv?
Instsrv is a Microsoft-developed utility used to install a Srvany Service.
It does not participate in the actual running of an application as a service - it just helps with the installation.
-
Where can I download Srvany and Instsrv?
The most recent version of Srvany and Instsrv are freely available as part of the
Windows Server 2003 Resource Kit Tools package.
-
How do I use Srvany to run my application as a service?
Microsoft's How To Create a User-Defined Service
article describes how to install an application as a Windows Service.
-
Is there a new version of Srvany for Windows Server 2008? For Windows 7?
No. Srvany and Instsrv were last released with Windows Server 2003 and no modifications have been made for Windows 7, Vista, Server 2008 or Server 2008 R2.
Note that these tools will work fine on Windows 2008 and Windows 7, but their lack of knowledge of recent developments in Windows Services
(Session Zero isolation, Service Triggers, etc.) can sometimes present problems. Please be cautions in a production environment!
-
Is Srvany supported on Windows Server 2008? Windows 7?
No. Srvany (and the rest of the
Windows Server 2003 Resource Kit Tools)
are only supported on Windows Server 2003, Windows XP. And even then, the official documentation accompanying the resource kit cautions:
The SOFTWARE supplied in the Windows Resource Kit Tools is not supported under any Microsoft standard support program or service.
-
Is Srvany supported on 64-bit Windows?
No. Srvany (and the rest of the
Windows Server 2003 Resource Kit Tools)
are not supported on 64-bit platforms.
-
Can a Windows Service have a GUI? Should a Windows Service have a GUI?
Can it? Yes.
Should it? No.
But things are never that black and white...
First, realize that the Windows Services architecture does not impose any GUI-related restrictions on a service.
Services are free to create windows, tray icons, alert boxes or any other GUI elements, just like conventional windows applications can.
The key question is this: When a service creates a window, where will it be shown?
By default, the GUI elements from a Service appear in Session 0 -- the session/desktop created by Windows when your PC boots.
A user logging in to Session 0 can see the windows from a Service and interact with them normally. Interactive services "just work" there.
On Windows 2000, XP and Server 2003, the first non-remote user to log in to the PC is placed in Session 0.
If you walk up to the keyboard and mouse and log in, you will almost surely end up in Session 0.
Remote users can log in to Session 0 by starting the Remote Desktop application with the "/admin" flag.
For these users, interactive services work as expected and many Windows programs were architected this way.
Microsoft recently changed the playing field for interactive services though.
In Windows Vista, 7 and Server 2008,
Session 0 is now "isolated", and no user is allowed to log in there.
(This was done mainly for security concerns -- a virus infecting a service could force itself onto any desktop, which
the folks at Redmond now consider a "security risk".) The upshot is that the windows from a Service will no longer
show up on any user's desktop, effectively dealing a death blow the whole notion of interactive services.
Realizing that it would be difficult to do away with interactive services by decree however, Microsoft made several concessions
to keep interactive services on life support. The Interactive Services Detection Service (ISDS) was introduced to alert a
user whenever a service shows window or message box on Session 0. After flashing a few times on the task bar, the window it displays looks like this:
Clicking on the View the message button initiates a gut wrenching transition from the normal desktop to the very strange looking world of
Session 0 where the Service's windows are running (Notepad.exe in this case):
Despite the austere appearance, you can interact normally with your service's windows in Session 0. And when you are done,
clicking on the Return now button will magically transport you back you to your regular desktop.
It is easy to see that most users would be inconvenienced by always having to perform such an ackward
switch to Session 0 to interact with an application. This effectively limits the attractiveness of
an interactive service and any sane computer professional will certainly recommend against constructing
one today!
-
My question has not been answered here. Can you please help?
Of course! Please contact us via email or phone and we will get back to you ASAP.
(888) 881-CORE
