What Are Windows Services?
Windows services are background processes that start automatically or on-demand to provide functionality to the OS and applications. Services run in user session 0 (separate from the interactive user session) — invisible to the user but running continuously. Services do not require a user to be logged in. Common Windows services: Windows Update (wuauserv) — manages update downloads and installation. Windows Defender Antivirus Service (WinDefend) — real-time protection. Print Spooler (Spooler) — manages print jobs. DHCP Client (Dhcp) — obtains IP configuration from DHCP server. DNS Client (Dnscache) — caches DNS resolutions. Remote Desktop Services — enables RDP connections. Windows Audio (AudioSrv) — manages audio. Task Scheduler — runs scheduled tasks. Services are hosted in svchost.exe processes — multiple services share svchost instances.
Services Management Tool (services.msc)
Services console (services.msc): the primary tool for Windows service management. Access: run services.msc, or right-click Start → Computer Management → Services. Per-service properties (double-click a service): General tab: service name, display name, description, executable path, startup type, service status (Start/Stop/Pause/Resume). Log On tab: which account the service runs as (Local System, Local Service, Network Service, or a specific account). Recovery tab: what to do if the service fails (Do Nothing, Restart the Service, Run a Program, Restart the Computer). Dependencies tab: which other services this service depends on and which services depend on it. Startup types: Automatic — starts when Windows starts. Automatic (Delayed Start) — starts a short time after other automatic services (reduces boot time). Manual — starts only when requested by a process or user. Disabled — will not start under any circumstances.
Common Service Issues
Service fails to start: check Event Viewer → Windows Logs → System for service failure events. Check service dependencies (Dependencies tab in properties) — a dependent service may not be running. Verify the service account has appropriate permissions. Check if the service executable exists at the stated path. Service crashes repeatedly: check Recovery tab — configure 'Restart the Service' on first and second failure. Event Viewer Application log for application-specific errors. Service running but not functioning: check if the service is listening on the expected port (netstat -a). Firewall may be blocking connections. Check service configuration files. sc command: command-line service management. `sc query servicename` (status), `sc start servicename`, `sc stop servicename`, `sc config servicename start=auto` (change startup type). net command: `net start servicename`, `net stop servicename`.
Service Accounts and Security
Services run under specific accounts that determine their permissions. Built-in service accounts: Local System (NT AUTHORITY\SYSTEM): most privileges — has almost unlimited local access. Avoid using for services unless absolutely required. Local Service (NT AUTHORITY\LOCAL SERVICE): reduced privileges — local access only. Network Service (NT AUTHORITY\NETWORK SERVICE): limited local rights but can authenticate to network resources as the computer account. Custom service accounts: create a dedicated user account with minimal required permissions. Best practice for services that need specific access. Managed Service Accounts (MSAs) and Group Managed Service Accounts (gMSAs): Active Directory accounts for services — automatic password rotation, no manual password management. Never run a service as a regular domain user or admin account unless necessary — if the service is compromised, the attacker gains those account privileges.
Troubleshooting with Task Manager and Process Explorer
Task Manager → Services tab: quick view of all services, start/stop/restart. Right-click → Open Services: jump to services.msc for full management. Process Explorer (Sysinternals): hover over a svchost.exe process to see which services are hosted in it (in tooltip). Click svchost.exe process → lower pane shows all hosted services. Useful for identifying which service is consuming CPU/memory within a shared svchost. Dependencies troubleshooting: if a service fails to start, check the error code. Common codes: Error 1053 (service did not respond to start request in timely fashion — timeout), Error 1067 (process terminated unexpectedly — check application log), Error 5 (access denied — service account permissions issue). System log Event IDs: 7031 (service terminated unexpectedly), 7034 (service terminated unexpectedly Nth time), 7036 (service entered running/stopped state).