1 of 73

Windows Services�Windows 11 and Server 2022�Manage-Configure-Troubleshoot

TECH SAVVY PRODUCTIONS

​

Created by:

Lowell Vanderpool & Nathan Vanderpool

2 of 73

Compare Win11 vs Server 2022

  • Windows 11 is a thick client and has over 200 Services preinstalled
  • Server 2016-2019-2022 Core has +/- 56 Services preinstalled
    • Using the SC command, you can on Server Core quickly create a text file with your installed services

2

3 of 73

Installed services are not all running!

  • Using PowerShell:
    • Get-Service | Where {$_.status –eq 'running’}
  • Running service are impacting your operating system
  • Microsoft works hard at keeping unneeded services from running

3

4 of 73

What are services?

4

  • Modules of critical software running in processes
  • Critical to:
    • Network functions
    • Applications
    • General operating system functions

​

5 of 73

Run: msconfig

  • Microsoft creates all the 90% of the services of Windows 11 & Server 2022
  • 3rd Party application often add services
  • msconfig quickly allows you to see 3rd party services

​

5

6 of 73

Services.exe: Service Control Manager

6

7 of 73

GUI interface to services.exe

  • GUI interfaces
    • Services.msc
  • Command-line
    • Sc
  • PowerShell
    • commandlets

7

8 of 73

8

9 of 73

9

10 of 73

PsService

  • Sysinternals has a great admin tool for services
    • enables you to logon to a remote system using a different account
    • includes a unique service-search capability, which identifies active instances of a service on your network.
    • displays the status, configuration, and dependencies of a service, and allows you to start, stop, pause, resume and restart them.

10

11 of 73

Services:

  • Run without a user logged on
  • Run with a user logged on in the background
  • Most Services Run in Session 0, users run in other Sessions
    • Security from user's applications
    • Isolation from user's applications

​

​

11

12 of 73

Services and Sessions in XP

12

13 of 73

Services and Sessions after Vista

13

14 of 73

Windows Sessions

14

Services cannot directly interact with a user due to separate sessions

15 of 73

Services need accounts to run

Service accounts are a special type of non-human privileged account used to execute applications and run automated services, virtual machine instances, and other processes.

15

16 of 73

16

17 of 73

17

18 of 73

System account

  • The SYSTEM account is used by the operating system and by services that run under Windows.
    • Is created when you install Windows 11 or Server 2022
    • the capability to sign in internally
    • It is an internal account that does not show up in User Manager, and it cannot be added to any groups

​

18

19 of 73

Special accounts run services

  • The LocalSystem account is a predefined local account used by the service control manager (SCM).
    • It has extensive privileges on the local computer, and acts as the computer on the network
    • SCM can modify with Local System to have Network Restricted rights

​

19

20 of 73

20

21 of 73

My anti-virus service

  • Runs under the credentials of SYSTEM
  • Service Control Manager shows it running under the Local System account
    • This account does not have a password.
    • The account is not associated with any logged-on user account.

21

22 of 73

22

SCM can modify Local System with Network restricted rights

23 of 73

Special accounts run services

  • The NETWORK SERVICE account is a predefined local account used by the service control manager
    • This account is not recognized by the security subsystem
    • It has minimum privileges on the local computer and acts as the computer on the network

​

23

24 of 73

24

25 of 73

Special accounts run services

  • The LOCAL SERVICE account is a predefined local account used by the service control manager.
    • It has minimum privileges on the local computer and presents anonymous credentials on the network
    • SCM can modify Local Service with No Network rights
    • SCM can modify Local Service with Network Restricted rights

25

26 of 73

26

27 of 73

27

SCM can modify Local Service with NoNetwork rights

28 of 73

28

Windows service accounts are one of the preferred attack surface for privilege escalation.

​

If you are able to compromise such an account, it is quite easy to get the highest privileges, mainly due to the powerful impersonation privileges that are granted by default to services by the operating system.

​

​

29 of 73

Managed Service Accounts

  • Win2008R2 & Win7 allows managed service accounts MSA and virtual service accounts
  • Server 2016 introduced gMSA (group Managed Service Account)

​

29

30 of 73

30

gMSA accounts are critical to applications like:

Exchange

SQL

Web-Servers

Containers

31 of 73

Svchost.exe

Why are so many services running under that same executable?

31

32 of 73

Svchost.exe

32

  • Svchost.exe (Service Host, or SvcHost) is a system process that can host from one or more Windows services

​

  • svchost.exe is a shared-service process that serves as a shell for loading services from DLL files

33 of 73

33

34 of 73

Svchost.exe Windows 11/10

  • systems with more than 3.5 GB of RAM
    • services that were previously grouped will instead be separated - each will run in its own SvcHost process.
    • Increased reliability by insulating critical network services from the failure of another non-network service in the host and adding the ability to restore networking connectivity seamlessly when networking components crash.
    • Reduced support costs by eliminating the troubleshooting overhead associated with isolating misbehaving services in the shared host.
    • Increased security by providing additional inter-service isolation
    • Increased scalability by allowing per-service settings and privileges
    • Improved resource management through per-service CPU, I/O and memory management and increase clear diagnostic data (report CPU, I/O and network usage per service).

​

34

35 of 73

x86 and x64 Services?

35

36 of 73

x64 Services and x32 Services

36

  • %SystemRoot%\System32\Svchost.exe x64
  • %SystemRoot%\SysWOW64\Svchost.exe x32

37 of 73

Where are services in the Registry?

37

38 of 73

Regedit: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

38

  • Note: always do a restore point before using Regedit to modify a service in the registry

​

  • In Windows Server export any registry key prior to editing so you have a backup of the original

39 of 73

Services can have complex

interrelationships

39

40 of 73

Dependencies

  • Complex interdependencies exist between many services
  • If IP Helper Service is unstable it could be caused by any of the list of depending services
  • Network Connectivity Assistant depends on a functioning IP Helper service

40

41 of 73

  • IP Helper Service

41

42 of 73

42

Service Dependencies on a single host

Troubleshooting services can be challenging!

43 of 73

43

  • In client –server applications you can have services on a server interacting and depending on services running on a client.

​

  • Enterprise/Business Applications take full advantage of this complex dependance of services not only on each host but on the server also.

44 of 73

Startup Type

  • Microsoft added Automatic (Delayed Start) to improve boot time for users
  • (Trigger Start) feature allows the operating system based on an event to start a service

44

45 of 73

Services Recovery

Administrators can modify how they want the operating system to handle service failures.

45

46 of 73

Recovery settings for Server Applications

  • Most Enterprise applications will give best practices for recovery settings and even scripts to run upon failure.

46

47 of 73

Monitoring Services

  • GitHub has many PowerShell scripts are available to monitor all your services and notify you if any service: restarts, stopped, etc. via email
  • Using Task Manager, you can automate your scripts to run on any schedule

47

48 of 73

Can I turn any application into a Windows Service?

Yes / No

48

49 of 73

Can you Yes, should you ????

  • Many 3rd party tools allow you to take normal user applications and turn them into a Windows service.
  • Should you:
    • You will have to manually update the application
    • Make sure the application is not automatically running after log on prior to settings it up as a service
      • You could end up with two instances running
    • You will not have an interface to the application once a service

​

49

50 of 73

Troubleshooting Services

Start with 3rd party

50

51 of 73

Troubleshooting Services

  • Using Event viewer to troubleshoot services:
    • Security
    • Crashes
    • Failed services
  • Look for critical events using “Service Control Manager” as your event sources

​

​

51

52 of 73

52

53 of 73

Using Event logs to Troubleshoot services

  • Many different type failures in services require looking at a variety of event IDs for problems.
    • Authentication failures can cause a service to fail to start
    • Services can cause unexpected reboots Event ID 41
    • Services can cause application hangs or faults Event ID 1002 or 1000
    • Services can timeout Event ID 7009
  • Event ID and their descriptions are notoriously generic and sometimes unhelpful, but it may lead you to a potential problem

​

53

54 of 73

Services fail often due to:

  • Missing *.dll files
  • Corrupted *.dll files

​

54

55 of 73

DISM repair system files

  • DISM.exe /Online /Cleanup-image /Restorehealth
    • Uses Windows Update to provide the files that are required to fix corruptions
  • At an Admin command prompt:
    • Sfc /scannow
    • You can perform this in safe mode
    • To view the CBS.log file
      • findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt"
      • Open text file and review

55

56 of 73

56

57 of 73

57

58 of 73

58

CBS.log

59 of 73

Fixing *.dll files

  • Restore server from good backups

59

60 of 73

60

This video series is a comprehensive study using powerful tools to lift the hood of the Windows Operating System and allow the tech to understand and troubleshoot applications and services.

​

We will cover how to use Process Explorer, Process Hacker and many other Sysinternal tools but most importantly we will discover how Windows really works and how we can understand our applications and effectively troubleshoot problems. From your PC/laptop to servers this understanding is critical to every IT professional. �

TECHSAVVYPRODUCTIONS.COM

Day 1: Troubleshooting Windows Applications. What is a process and What are threads?

YouTube: https://youtu.be/H1eN5kGJ5oc

61 of 73

61

This video series is a comprehensive study using powerful tools to lift the hood of the Windows Operating System and allow the tech to understand and troubleshoot applications and services. We will dive into process types and how our tools categorize processes.

​

We will cover how to use Process Explorer, Process Hacker, and many other Sysinternal tools but most importantly we will discover how Windows really works and how we can understand our applications and effectively troubleshoot problems. From your PC/laptop to servers this understanding is critical to every IT professional.�

TECHSAVVYPRODUCTIONS.COM

Day 2: Troubleshooting Windows Applications. Types of Applications and Processes.

YouTube: https://youtu.be/My-n26Xl7ok

62 of 73

62

This video series is a comprehensive study using powerful tools to lift the hood of the Windows Operating System and allow the tech to understand and troubleshoot applications and services. Keep a good attitude! We will dive into powerful features of Process Explorer and in doing so learn more about processes, process states and a better understanding of how programs run in RAM and the page file.

​

We will cover how to use Process Explorer, Process Hacker and many other Sysinternal tools but most importantly we will discover how Windows really works and how we can understand our applications and effectively troubleshoot problems. From your PC/laptop to servers this understanding is critical to every IT professional. �

TECHSAVVYPRODUCTIONS.COM

Day 3: Troubleshooting Windows Applications: Process States

YouTube: https://youtu.be/g68UQCId4uQ

63 of 73

63

We will look at Process Explorer Metrics, understanding these values, and how to apply them to analyzing and troubleshooting applications. Why context delta is such an important metric to use in analyzing processes. This video series is a comprehensive study using powerful tools to lift the hood of the Windows Operating System and allow the tech to understand and troubleshoot applications and services. We will dive into powerful features of Process Explorer and in doing so learn more about processes, process states, and a better understanding of how programs run in RAM and the page file.

​

We will cover how to use Process Explorer, Process Hacker, and many other Sysinternal tools but most importantly we will discover how Windows really works and how we can understand our applications and effectively troubleshoot problems. From your PC/laptop to servers this understanding is critical to every IT professional.

TECHSAVVYPRODUCTIONS.COM

Day 4: Process Explorer Metrics and Troubleshooting Windows Applications

YouTube: https://youtu.be/0_stNrjBv9k

64 of 73

64

A quick look at the Windows 11 Microsoft store and the promises of Microsoft. Why do Windows Apps have such tight security? How to identify Windows Apps in Process Explorer. How do we run 32-bit apps in an x64 operating system? A look at the framework for Windows Apps. Android apps and how they will work in Windows 11. A peek at Windows 11 and ARM. This video series is a comprehensive study using powerful tools to lift the hood of the Windows Operating System and allow the tech to understand and troubleshoot applications and services. We will dive into powerful features of Process Explorer and in doing so learn more about processes, process states, and a better understanding of how programs run in RAM and the page file.

​

We will cover how to use Process Explorer, Process Hacker, and many other Sysinternal tools but most importantly we will discover how Windows really works and how we can understand our applications and effectively troubleshoot problems. From your PC/laptop to servers this understanding is critical to every IT professional.

TECHSAVVYPRODUCTIONS.COM

Day 5: A Look at Microsoft Store Apps and Why we don’t Troubleshoot them!

YouTube: https://youtu.be/UvOjmOXUU5I

65 of 73

65

How Microsoft is developing frameworks allowing Linux GUI applications to run with the Windows Subsystem for Linux. My favorite 3rd party Windows application support tools. Understanding the importance of processes and why all operating systems use them. How all processes use IPC or Interprocess communication protocols to share and communicate with each other. What are handles? This video series is a comprehensive study using powerful tools to lift the hood of the Windows Operating System and allow the tech to understand and troubleshoot applications and services. Keep a good attitude!

We will dive into powerful features of Process Explorer and in doing so learn more about processes, process states and a better understanding of how programs run in RAM and the page file. We will cover how to use Process Explorer, Process Hacker and many other Sysinternal tools but most importantly we will discover how Windows really works and how we can understand our applications and effectively troubleshoot problems. From your PC/laptop to servers this understanding is critical to every IT professional.�

TECHSAVVYPRODUCTIONS.COM

Day 6: Linux GUI Applications are coming to Windows

YouTube: https://youtu.be/FikZ0tiovS8

66 of 73

66

What are Dynamic Link Libraries or *.dll files. Why are they so critical to Windows and Windows Applications? Learn who can execute *.dll files. Why is ntdll.dll one of the most critical DLL files in Windows? A look at application memory, private bytes, working set and page faults. The basics of application troubleshooting. This video series is a comprehensive study using powerful tools to lift the hood of the Windows Operating System and allow the tech to understand and troubleshoot applications and services. Keep a good attitude! We will dive into powerful features of Process Explorer and in doing so learn more about processes, process states and a better understanding of how programs run in RAM and the page file.

TECHSAVVYPRODUCTIONS.COM

Day 7: Understanding Application *.DLL files

YouTube: https://youtu.be/_EFcQJC-lWQ

67 of 73

67

A technical comparison between Windows 11 and Server 2022. A look at over 200 services on Windows 11 and why server has so few. A review of Server Core and the importance of server hardware. Why Windows Server operating systems are stable and reliable compared to laptops and desktops running Windows clients? Why Azure makes sense for many companies looking to expand their Windows environment. What are server roles and features?

TECHSAVVYPRODUCTIONS.COM

Comparing Windows 11 vs Windows Server 2022

YouTube: https://youtu.be/qSSPBXuHhd0

68 of 73

CONTACT US�mrvanderpool@techsavvyproductions.com�nathan@techsavvyproductions.com�

SOCIAL MEDIA

​

​

CREDITS

  • Social media logos and “Tech Savvy Productions” teaser created by The 11th Hour: https://www.youtube.com/user/The11thH...

​

68

69 of 73

Become a member

69

70 of 73

Check out our website: �https://www.techsavvyproductions.com

70

71 of 73

Want an easy and free way to support this Channel?�Please Subscribe!�80% of the individuals who watch our content do not subscribe.�

71

72 of 73

We have subtitles for the following languages:

We translate subtitles on our videos into the following languages: عربى, българскиB, 简体中文）, 中國傳統的）, Nederlands, Suomalainen, Pilipino, français, Deutsche, हिंदी , Magyar, bahasa Indonesia, 日本語, 한국어, norsk, Polskie, português, Română, русский, Española, Kiswahili, Svenska, and Tiếng Việt

​

72

73 of 73

�A BIG THANK YOU TO ALL OF OUR VIEWERS AND SUBSCRIBERS!�

73