MSI Services

What are services?

A Windows Service is an application that does not have a user interface. It commonly runs without human intervention and can be automatically started when the computer starts up. Examples of Windows Services are the Internet Information Server (IIS), Telnet, and FTP. By definition, it’s a program that runs invisibly in the background. The same thing can be said for a number of programs that run in the background such as anti-virus programs but the real difference is that services load and start running whether or not anyone logs into the computer, unlike a program that is launched from the Startup Folder under All Programs.

How to view Services?

There are two ways to view Services on your computer. The first is to use the MS Configuration Utility by typing msconfig.exe in the Run box accessed via the Start Menu, followed by clicking the Services tab. If you want a quick visual of which items are running or stopped, this is fine, but the information is limited. The preferred way to make changes to services is to launch services.msc from the Run option on the Start Menu. The Services window shown below will open.

Types of Services

Looking at the Services window you can see it has columns for Name, Description, Status, Startup Type and Log On As. This provides a quick overview of all the services on your computer. Detailed information is available by clicking any of the entries. The Status is the current state of the service. Here, you will either see Started or blank. The blank represents that the service is not started and is not currently running. Just because a service is not started, does not make the computer protected from the service. The reason is that each service has “the opportunity” to start, if configured to do so. This is where the Startup Type is so important. There are three options for Startup Types:

Automatic – This will start the service when the computer boots. Most of the required services that we investigate will need to have this startup mode in order to be running during the boot process and immediately after the computer boots.

Manual – This mode will not start the service upon the boot process. Rather, it keeps the service from running until the service is needed. The service can be started in a number of ways. There can be automatic methods such as installing an application or starting a dependent service. The service can also be manual started by an administrator right-clicking on the service and selecting Start from the menu.

Disabled – This will not allow the service to start automatically or manually. The only way to start the service from this state is to first move the Startup Type to Automatic or Manual, then start the service.

Finally, you have the Log On As column, which is the same as the “service account” for the service. This is the account that will drive the service for the operating system. Most of the default services that are installed on a Windows 2000 and Server 2003 domain controller use the LocalSystem. The LocalSystem user account is really not a “user account” in the sense as the Administrator user account. This account is a system account controlled by the server. The LocalSystem does have system access, which is a bit above the Administrator user account. Windows XP and Windows Server 2003 servers also use a new account, named the “Network Services” account. This account is designed specifically for use with services that need to communicate with other computers on the network. The “Network Services” account provides better security than the “LocalSystem” account by design and should be used when ever the service can function with this account. There are two more tidbits on services which are not visible in the Computer Management Console. First, some services can be uninstalled, rather than just disabled. As you can imagine, if a service is not required, there is no need for it to be on the computer. For some services, this is just not possible. The second one is the service Access Control List (ACL). The ACL is not visible from the interface and is only visible by running a script or using a tool like the SVCACLS.EXE tool from the Windows Resource Kit. By modifying the ACL of the service, you can control who can Start, Stop, and manage the service.