The Core Technologies Blog

Professional Software for Windows Services / 24×7 Operation


Q&A: I created a Windows Service with SC. Why won’t it Start?

Q&A: SC Windows Service won't start
  I installed my program as a Windows Service using the SC command. The result was “CreateService SUCCESS”, and my service is listed with all the others so I know it worked.

But whenever I try to start the service, the NET command fails with “The service is not responding to the control function”. What does that mean? Why can’t I start the service?

— Marc B.

Hi Marc.

You are running into a common problem with the SC utility. While SC will happily install any script, batch file or executable as a service, the service it creates may not be usable!

Let’s dig into the details.

SC is not picky; it will install anything as a service

As you have discovered, the “SC CREATE” command will create a new Windows Service. The command line must look like this:

SC CREATE <SERVICE-NAME> binpath= "<FULL-PATH-TO-PROGRAM>"

(Yes — the space after “binpath=” is required!)

Apparently all you need to specify is a friendly name and the full path to your program for SC to work it’s magic. Simple, right?

For example, to install the Windows Notepad application as a service called “NotepadService”, run this command from an administrative command prompt:

SC CREATE NotepadService binpath= "C:\Windows\Notepad.exe"

SC will confirm success:

SC creates a new service

And the new service will be listed in the Services application:

New service in services.msc

But there are limits to what SC will do. Even as it dutifully performs the basic operations — creating the necessary entries in the Windows Registry — SC will not validate the path/program in any way. This means that:

  1. SC will succeed even if the program does not exist. You can give it a bogus path and see:

    SC installs non-existent program

    However, the following error pops up when you try to start the “BadPath” service installed above:

    You can't start a service with a bad path
  2. SC will succeed even if the program cannot run. For example, here we have installed a ridiculous service where the path is an MP3 music file:

    SC creates an MP3 service

    Indeed, as an MP3 is not a valid application, it is no surprise that attempting to start the service results in failure:

    You can't start a MP3 file as a service

So, as we have shown, SC is firmly focused on basic installation — not operation. The fact that a service was created with SC does not mean that the service can ever start or run.

Only a “true” Windows Service Application can be started as a service

Even though SC will install any program as a service, the reality is that only specially constructed executables can actually operate as a service. We call those Service Applications.

Service applications implement the Windows Services API — a set of operations used to control and monitor services. Windows uses the API to interact with Service Applications.

The API is quite extensive. With it, Windows can command any Service Application to:

  • start running
  • stop running
  • report status
  • pause
  • resume running
  • prepare for system shutdown

Unfortunately regular desktop applications (like Microsoft Word, Google Chrome and Adobe Acrobat Reader) do not support the Windows Services API. They are not Service Applications. There is simply no way for Windows to directly control or interrogate any of those desktop programs as a service.

Non-Service Applications will fail to start, citing error 1053

To illustrate, let’s take Dropbox — a leading cloud storage provider. The company produces Dropbox.exe, a desktop application that synchronizes files between your PC and the cloud. Dropbox.exe is not a service application.

As you can see, SC has no problem installing Dropbox as a service:

SC creates Dropbox service

But when you try to start the Dropbox Service from the Services application, a curious scenario plays out:

  1. Windows starts Dropbox.exe.

    Here you can see Dropbox (and its two helper processes) running in Process Explorer:

    Dropbox.exe has been started
  2. Next, the Service Control window will report that “Windows is attempting to start” the service:

    Windows is attempting to start the Dropbox service
  3. And after about 30 seconds, the Dropbox.exe processes vanish from the system and Error 1053 is raised:

    Dropbox service failed to start with Error 1053

Even though Windows kicked off Dropbox.exe as intended, the process was terminated in less than 40 seconds. A clear failure.

And the story is the same with other regular, non-service applications as well. They all misfire in the same way.

Why did the Dropbox service fail to start?

The problem occurs in step 2.

After launching Dropbox.exe (step 1), Windows waits for the new process to report its status and confirm that the service has started properly. However, since Dropbox does not support the Windows Services API, it fails to respond to that service-specific status check.

And after a few seconds of lingering, Windows eventually gives up. It terminates the Dropbox.exe process (and all its sub-processes) and reports that “the application did not respond to the start or control request in a timely fashion” (i.e. error 1053).

Use a “Service Wrapper” to install a regular program as a Windows Service

As demonstrated above, you cannot simply install a regular application with SC and expect the service to work. You need help from a special “go-between”.

A service wrapper is a Service Application that starts and stops another application in response to important events. When a service wrapper receives a Windows Services API request, it acknowledges the request and performs the appropriate action on the application it is managing.

For example, let’s say that we have a service wrapper configured to manage Notepad. When the service wrapper receives a “start the service” request, it would start a new instance of Notepad.exe and let Windows know that the service was started successfully.

And when the service wrapper receives a “stop the service” demand, it would terminate the Notepad process it started before exiting itself.

Perhaps the best known service wrapper is Microsoft’s Srvany. Srvany is free and functional, but has some significant shortcomings.

Alternatively, our AlwaysUp utility is a professional service wrapper. It’s not free, but is robust and mature, and makes running your application in the background as a Windows Service super easy.

Posted in Windows Services | Tagged , , , , | Leave a comment

Q&A: Why is the Stop Button Disabled for my Windows Service?

Why is the Stop Button Disabled for my Windows Service?
  I want to stop a running service but can’t because the Stop button is grayed out. I am logged into an Administrator account and all other user accounts are logged off. Any ideas why I may be unable to stop the service?

Thank you, all, for your help.

— Matteo

Hi Matteo. Here are 4 potential reasons why the stop button is disabled:

1. The service is temporarily busy

Every now and then, Windows interrogates your service to ask an important question: What operations can users perform?

The service must respond to that status check with the list of operations it is willing to accept at that time. For example, if the service is running, the response might indicate that it is OK for someone to:

  • Stop the service
  • Pause the service
  • Send a trigger event

Notice that the list would not include “Start the service” because the service is already running.

The Services application uses the response to enable and disable buttons on the service’s properties window. A button will be disabled if its corresponding operation cannot be performed.

So, for whatever reason, your service may not be accepting the “Stop the service” operation at the current time. But that could be temporary. Try closing and reopening the Services application and see if the stop button is eventually enabled. Maybe fortune will smile on you. 🙂

2. The service is “unstoppable”

Some services simply refuse to accept the stop command at any time. They resolutely respond to the “What operations can users perform?” status check with “I cannot stop”.

You can detect one of those unstoppable services using the powerful SC command. Run this command (from an administrative command prompt) and look for NOT_STOPPABLE in the STATE:

sc query <Service-Name>

For example, the critical DCOM Server Process Launcher (DcomLaunch) is unstoppable:

The DcomLaunch service is unstoppable

And as a result, all its buttons are disabled:

DcomLaunch service buttons grayed out

Is your service unstoppable? Perhaps it is a critical service that needs to run all the time. The only reliable way to stop one of those services is to shut down the computer.

3. The service is hung/stuck

By definition, an unresponsive Windows Service does not answer the periodic status check. The consequence is that no operations can be performed on the service. All its buttons will be disabled in the Services application, as we see here with a service developed by one of our customers:

Windows Service buttons disabled

Put on your detective hat and check the Event Viewer for errors and warnings from your service. Maybe something is going wrong that you (or the author of the software) should address.

4. You don’t have permission to stop the service

The Stop button may be grayed out because you simply don’t have the right to press it.

Are you an administrator on your PC? If so, you might be able to grant yourself the ability to stop the service using our free Service Security Editor utility. Please review this article to showing how to adjust the rights of your Windows Service.

For example, here we see that user “Mike Jones” is explicitly prevented from stopping a service on our Windows Server 2019 machine:

Stop service denied

We removed the check mark from the Deny column and added it to the Allow column (and clicked the Apply button) to enable Mike to stop the service:

Allow stop service

How to forcibly stop your service

Each Windows Service is backed by a process listed in Task Manager. Terminating that process will stop the service. Here is how to do that, referencing the Print Spooler service as an example:

  1. Find the name of your service. It will be displayed at the top of the service’s properties window.

    For example, the name of the Print Spooler service is Spooler:

    Print Spooler service name

  2. Start an administrative command prompt.

  3. Run this command, replacing <SERVICE-NAME> with the name of the service you found in step 1:

    sc queryex "<SERVICE-NAME>"

    Note the PID value in the command’s output (2444 in this example):

    Query the status of the Spooler service
  4. Replacing <PID> with the PID you collected, run this command to forcibly terminate the service’s process:

    taskkill /F /T /PID <PID>

    Use Taskkill to terminate the Spooler process

If all goes well, your service should stop.

Best of luck!

Posted in Windows Services | Tagged , , , , | 2 Comments

4 Amazing Benefits of Monitoring & Auto-Restarting your Mission-Critical Applications

4 Amazing Benefits of Auto-Restarting your Mission-Critical Software

Does your company rely on one or more important Windows applications?

Will your business (and reputation) suffer if those programs stop running or become unavailable?

If so, downtime is your enemy. Look to our AlwaysUp and Service Protector utilities to help you ensure that your applications start at boot and continue to run 24/7 — even in the face of failure.

And getting closer to 100% uptime can have a huge impact on your business. Here are four of the most important benefits of monitoring and automatically restarting your vital Windows software:

1. Fewer support calls

Less support calls

Frustrated customers make phone calls and send angry emails when software stops working. Someone in your company has to take those calls and respond to those emails — often at considerable time and expense.

Automatically curing failures eliminates those infuriating “your software is down again!” complaints. Your support staff will thank you. And even better, they will have more time to focus on the higher-value interactions that move your company forward, not backward.

2. Less off-hours interruptions

Less off-hours interruptions

Picture this: You’re at a pricey restaurant enjoying a rare evening out with friends when your phone rings. It’s your boss. An important customer is down and you need to restore service now.

You rush to your car to get your laptop and spend the next 30 minutes frantically connecting to a secure Wi-Fi network, logging into the VPN and ultimately restarting the offending application. By the time you get back to the table, your dinner is cold and your friends are ready to move on. That sucks!

But none of that needed to happen.

In an alternate universe — one where a “set-it-and-forget-it” application monitoring package has your back — the failure was detected, your application was automatically recycled and your customer was never inconvenienced. You received a friendly email letting you know what happened, just as you started your main course. You didn’t miss a beat.

3. Happier customers

Happier customers

Customers despise buggy software. It can be very stressful when they are trying to complete urgent tasks but the supporting software is down!

Making sure that your software is always available reduces stress. And less stress leads to happier, satisfied customers who remain loyal for years to come.

4. More time to focus on your business

More time to focus on your business

With fewer support calls and less toxic interruptions, you will have a few extra hours each month to focus on important issues. How will you use that valuable time?

Of course, you can move on to fighting the next customer “fire”. There are always lots of those.

But even better, why not focus on advancing and growing your business — for all customers?

P.S. Check out these 30 customer service tips from the folks at Nextiva.

Posted in Uptime | Tagged , , , | Leave a comment

Q&A: What’s the difference between a Windows Service and a Web Service?

Windows Service vs Web Service
  I see that your website has a lot of information about Windows Services and you also make AlwaysUp Web Service. How is a Windows Service different than a Web Service? When would I use one over the other? I’m new to programming and a bit confused by the terminologies.

— Justin

Hi Justin.

Yes, the terminology can be confusing! Let’s start with some definitions.

What is a Windows Service?

A Windows Service:

  • Is a Windows application that integrates with the Service Control Manager.
  • Is controlled through the Services Control Panel application.
  • Implements system-level tasks that must operate outside the boundaries of a user’s login session.
  • Is usually long-running, starting when the computer boots and running uninterrupted, 24/7.
  • Works invisibly in the background. A service can’t easily show itself on a user’s desktop.
  • Can do anything that a “regular” application can. Services can read and write files, print documents, check the time, access the network, and much more.
  • Runs on Windows only. Windows Services are not available on Linux, macOS, Andriod, iOS or any other operating system.
  • Is typically written in C++ or C# (to best work with the low-level Windows Services API).
  • May or may not communicate with other programs. Inter-application communication is not a key feature and most services do not expose an interface of any kind.

A modern PC comes with one to two hundred Windows Services pre-installed, each managing an important aspect of your computing experience. For example:

  • Print Spooler: Manages all printing on your computer.

  • Power: Implements your computer’s power schemes, policies and notifications.

  • Task Scheduler: Responsible for automatically launching executables, batch files and scripts at specified times, without human intervention.

What is a Web Service?

A Web Service:

  • Interacts with other applications or services using a well-defined system of data exchange (such as REST or SOAP).
  • Typically communicates over HTTP with an appropriate messaging format on top (such as XML or JSON).
  • Is usually hosted in a web server/container, like Apache Tomcat, Microsoft IIS or Play Framework. A good framework provides easy-to-use messaging “plumbing” and makes it significantly simpler to develop a robust web service.
  • Has a web-based interface (if any at all).
  • Is not restricted to Windows alone. In fact, most web services are deployed on UNIX servers.

Examples of web services include:

Amazon Simple Storage Service (S3): Integrate cloud storage into any application.
Google Maps: Lookup addresses, plot directions, access street views and more.
WorldTimeAPI: Get the current time in any time zone.

The upshot: Windows Services and Web Services are very different!

The only things they have in common are that they are both server technologies and have the word “Service” in their names. 🙂 As a developer, you shouldn’t have much trouble choosing which technology is appropriate for your project.

However, the W* Services are not completely complementary. Though rare, there are a few applications that are both a Windows Service and web service. A good example is our own AlwaysUp Web Service, which must run 24×7 on Windows while providing an XML web service to control the computer remotely.

I hope these similar-sounding technologies make a bit more sense now. Please be sure to get in touch if you have any other questions.

Posted in Windows Services | Tagged , , | Leave a comment

Windows Services Memory Fix (Microsoft June 2020 Patch Tuesday)

Windows Services Memory Fix

On the second Tuesday of each month, Microsoft releases the latest security updates for Windows, Windows Server, and other products. This monthly event is dubbed Patch Tuesday.

The June 2020 Patch Tuesday update fixes a whopping 129 important defects. It’s the largest Patch Tuesday update ever!

As usual, we’ve scoured the list of vulnerabilities to identify fixes focused on Windows Services. Fortunately there is just one item — CVE-2020-1268.

CVE-2020-1268: Windows Service Information Disclosure Vulnerability

According to Microsoft, an attacker could leverage CVE-2020-1268 to read private areas of a service’s memory. These kind of “memory exploits” are quite serious.

The patch fixes the problem by correcting how a Windows Service handles objects in memory.

How can an attacker exploit this defect?

To exploit the defect, an attacker would have to:

  • Log in to your Windows computer

  • Run a “specially crafted application”

  • Locate something of value in the service’s memory

That is, the defect is only exploitable by an authorized person with sophisticated programming experience.

Nevertheless, it presents a significant security hole.

For example, suppose your service caches a user’s credit card information securely in RAM. A rogue employee could craft a program that invades your service’s memory space and extracts the card details. The same stealing could happen with passwords, personally identifiable information and other sensitive data that your application records in memory.

Which versions of Windows does CVE-2020-1268 affect?

Microsoft has identified and developed patches for the operating systems impacted — Windows 10 (Versions 1903, 1909, 2004) and Windows Server 2019 (Versions 1903, 1909, 2004).

Apparently the flaw does not exist in Windows 8 or Windows Server 2016, Microsoft’s other supported operating systems.

What else do you know about CVE-2020-1268?

  • The vulnerability was not publicly disclosed prior to June 2020.

  • There are no reports of exploits in the wild.

  • CVE-2020-1268 does not allow an attacker to execute code or to elevate user rights directly.

  • Because it requires access and sophistication to exploit, Microsoft classifies it as “Exploitation less likely”.

Should I apply the patch?

Yes. We agree with Microsoft’s recommendation to apply the patch.

Because, as the folks at ZDNet wisely point out:

Malware authors are known to keep on eye out on Microsoft’s monthly security updates, select the most useful bugs, and patch-diff the security updates to find the exact bug that Microsoft fixed — so they can weaponize it as soon as possible.

Questions? Problems?

If you would like to know more about CVE-2020-1268 or the enormous June 2020 Patch Tuesday update, please feel free to get in touch. We will do our best to help you.

Be safe out there!

Posted in Windows Services | Tagged , , , , , | Leave a comment