Windows Services

Introduction

Windows services are programs that run in the background, independently of user sessions. They provide essential functionalities to the system.

Characteristics of Services

Differences with applications

Characteristic	Application	Service
Interface	Generally graphical	No interface (or limited)
Session	Linked to a user	Independent
Startup	Manual by the user	Automatic at boot
Execution	During the session	Continuous in the background

Startup types

Type	Description
Automatic	Starts at system boot
Automatic (Delayed)	Starts after boot, with delay
Manual	Starts only on demand
Disabled	Cannot start

Service accounts

Account	Privileges	Usage
LocalSystem	Full (admin)	Critical system services
LocalService	Limited, local only	Low-privilege services
NetworkService	Limited, network access	Services requiring network
User account	According to the account	Custom services

---

Management via GUI

Services.msc

Win+R > services.msc

Available information:

• Service name and description
• Status (Running, Stopped)
• Startup type
• Execution account

Task Manager

Services tab for quick view.

---

Management via PowerShell

List services

# All services
Get-Service

# Running services
Get-Service | Where-Object {$_.Status -eq "Running"}

# Search by name
Get-Service -Name "*update*"

# With WMI details
Get-WmiObject Win32_Service | Select-Object Name, DisplayName, State, StartMode, PathName

Start/Stop services

# Start
Start-Service -Name "ServiceName"

# Stop
Stop-Service -Name "ServiceName"

# Restart
Restart-Service -Name "ServiceName"

# With confirmation
Stop-Service -Name "Spooler" -Confirm

Change startup type

# Set to automatic
Set-Service -Name "ServiceName" -StartupType Automatic

# Disable
Set-Service -Name "ServiceName" -StartupType Disabled

Create a service

# Create a new service
New-Service -Name "MyService" `
    -BinaryPathName "C:\path\to\program.exe" `
    -DisplayName "My Custom Service" `
    -Description "Service description" `
    -StartupType Manual

# Delete (via sc.exe)
sc.exe delete "MyService"

---

Management via CMD

SC Command (Service Control)

:: List services
sc query

:: Service status
sc query "ServiceName"

:: Start
sc start "ServiceName"

:: Stop
sc stop "ServiceName"

:: Configure startup
sc config "ServiceName" start= auto
sc config "ServiceName" start= disabled

:: Create a service
sc create "MyService" binPath= "C:\path\program.exe"

:: Delete
sc delete "MyService"

NET Command

:: Start
net start "ServiceName"

:: Stop
net stop "ServiceName"

---

Important System Services

Critical Services

Service	Short name	Role
Windows Update	wuauserv	Updates
Windows Defender	WinDefend	Antivirus
Remote Procedure Call	RpcSs	System communication
DCOM Server Process Launcher	DcomLaunch	DCOM activation
Windows Event Log	EventLog	Logging
Task Scheduler	Schedule	Scheduled tasks
Print Spooler	Spooler	Printing

Network Services

Service	Short name	Role
DHCP Client	Dhcp	Automatic IP configuration
DNS Client	Dnscache	Name resolution
Windows Firewall	mpssvc	Firewall
Remote Desktop Services	TermService	Remote desktop
Server	LanmanServer	File sharing
Workstation	LanmanWorkstation	Access to shares

---

Service Security

Risks

1. Vulnerable services:

   • Modifiable executables
   • Too broad permissions
   • Over-privileged accounts

2. Attack vectors:

   • Binary replacement
   • DLL Hijacking
   • Unquoted service path

Security checks

# Check unquoted paths
Get-WmiObject Win32_Service | Where-Object {
    $_.PathName -notmatch '^"' -and 
    $_.PathName -match ' '
} | Select-Object Name, PathName

# Check executable permissions
Get-WmiObject Win32_Service | ForEach-Object {
    $path = $_.PathName -replace '"', '' -replace ' .*', ''
    if (Test-Path $path) {
        Get-Acl $path | Select-Object @{N='Service';E={$_.Name}}, Path, Owner
    }
}

Hardening

1. Principle of least privilege:

   • Use LocalService or NetworkService rather than LocalSystem
   • Create dedicated service accounts

2. Protect binaries:

   • Restrictive permissions on executables
   • Quoted paths

3. Disable unnecessary services:

   • Remote Registry
   • Print Spooler (if no printing)
   • Telnet (obsolete)

---

Service Dependencies

Understanding dependencies

A service may depend on other services to function.

# View service dependencies
Get-Service -Name "ServiceName" -DependentServices

# Services this service depends on
Get-Service -Name "ServiceName" -RequiredServices

Example: Print Spooler

Print Spooler
  ├── Depends on: Remote Procedure Call (RPC)
  └── Dependent services: (often none)

---

Service Logging

Event Log

# Service-related events
Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    ProviderName = 'Service Control Manager'
} -MaxEvents 20 | Format-Table TimeCreated, Message -Wrap

Important Event IDs

Event ID	Description
7000	Service failed to start
7001	Service depends on a service that did not start
7009	Timeout at startup
7034	Service terminated unexpectedly
7035	Start/stop request sent
7036	Service started or stopped

---

Exercises

1. List all running services on your system
2. Identify services running under LocalSystem
3. Find services with unquoted paths
4. Create a test service and delete it

---

References

• Microsoft: Services
• Service Control Manager