Core Technologies Consulting, LLC

Using SC to manage Service Triggers

on Windows 7 and Windows Server 2008 R2
Links
Home

Company

Products

Support


Core Technologies Consulting is a Microsoft Registered Member
Core Technologies Consulting is an Intel Software Partner

Service Triggers (aka Trigger-Start Services), introduced in Windows 7 and Windows Server 2008 R2, allow services to be started and stopped when certain conditions are met. Triggers can be managed with the venerable SC command-line utility, already used to control windows services. This page presents the trigger-related syntax of the SC command on Windows 7.

Configure Trigger Start Services with Service Trigger Editor Check out our free GUI application Service Trigger Editor, which provides an easy-to-use interface for managing Service Triggers. [screenshot]

Configuring Triggers

Triggers can be added, edited or removed using the sc triggerinfo command: 

C:\>sc triggerinfo
DESCRIPTION:
        Changes the trigger parameters of a service.
USAGE:
        sc  triggerinfo [service name]  ...

OPTIONS:
        start/device/UUID/HwId1/...    Start the service on arrival of the specified device interface class UUID
                                       string with one or more hardware ID strings and/or compatible ID strings.
									   
        start/custom/UUID/data0/..     Start the service on arrival of an event from the specified custom ETW
                                       provider UUID string with one or more binary data items in hexadecimal
                                       string format such as ABCDABCD to set 4 byte data.
									   
        stop/custom/UUID/data0/...     Stop the service on arrival of an event from the specified custom ETW
                                       provider UUID string with one or more binary data items in hexadecimal
                                       string format such as ABCDABCD to set 4 byte data.
									   
        start/strcustom/UUID/data0/..  Start the service on arrival of an event from the specified custom ETW
                                       provider UUID string with one or more optional string data items.
									   
        stop/strcustom/UUID/data0/..   Stop the service on arrival of an event from the specified custom ETW
                                       provider UUID string with one or more optional string data items.
									   
        start/networkon                Start the service on first IP address.
		
        stop/networkoff                Stop the service on zero IP addresses.
		
        start/domainjoin               Start the service on domain join.
		
        stop/domainleave               Stop the service on domain leave.
		
        start/portopen/parameter       Start the service on the opening of a network port. The parameter is of the
                                       semi-colon delimited form portnumber;protocolname;imagepath;servicename.
									   
        stop/portclose/parameter       Stop the service on the closing of a network port. The parameter is of the
                                       semi-colon delimited form portnumber;protocolname;imagepath;servicename.
									   
        start/machinepolicy            Start the service when machine group policy changes or is present at boot.
		
        start/userpolicy               Start the service when user group policy changes or is present at boot.
		
        delete                         Delete the existing trigger parameters.

Example: Stopping a service when a machine policy changes

To start the Fax service when a machine policy changes: 

C:\Windows\system32>sc triggerinfo "Fax" start/machinepolicy
[SC] ChangeServiceConfig2 SUCCESS

Querying Trigger Parameters

Use sc triggerinfo to see how a service is configured: 

C:\>sc qtriggerinfo
DESCRIPTION:
        Retrieves the trigger information of a service.
USAGE:
        sc  qtriggerinfo [service name]

Example

Here is the trigger information for the Computer Browser service, which maintains an updated list of computers on the network and supplies this list to computers: 

C:\>sc qtriggerinfo browser
[SC] QueryServiceConfig2 SUCCESS

SERVICE_NAME: browser

        START SERVICE
          FIREWALL PORT EVENT          : b7569e07-8421-4ee0-ad10-86915afdad09 [PORT OPEN]
            DATA                       : 139;TCP;System;
            DATA                       : 137;UDP;System;
            DATA                       : 138;UDP;System;
        STOP SERVICE
          FIREWALL PORT EVENT          : a144ed38-8e12-4de4-9d96-e64740b1a524 [PORT CLOSE]
            DATA                       : 139;TCP;System;
            DATA                       : 137;UDP;System;
            DATA                       : 138;UDP;System;