Many programs execute only when a user launches them.
Examples:
- notepad.exe
- chrome.exe
- powershell.exe
However, some software must operate even when no user is logged in.
Examples:
- Windows Update
- Antivirus Software
- Print Services
- Remote Management
- Database Servers
Windows uses services to provide this functionality.
Why This Matters
Many critical Windows functions depend on services.
Examples include:
| Function | Service |
|---|---|
| Windows Updates | wuauserv |
| Event Logging | EventLog |
| Printing | Spooler |
| Remote Management | WinRM |
| Remote Desktop | TermService |
| Microsoft Defender | WinDefend |
What Is A Service?
A service is a program that runs in the background.
Unlike most applications, services do not require direct user interaction.
Conceptually:
System Starts
↓
Service Starts
↓
Waits For Work
↓
Performs Work
Examples:
Web Server
↓
Waits For Request
↓
Responds
Print Service
↓
Waits For Print Job
↓
Prints Document
Services vs Processes
Students often confuse services and processes.
A service is:
A background function
A process is:
A running program
Conceptually:
Service
↓
Runs Inside
↓
Process
Example:
Windows Update Service
↓
svchost.exe Process
Every running service ultimately executes a process.
Service Startup Types
Services can start in different ways.
Common startup types include:
| Startup Type | Description |
|---|---|
| Automatic | Starts during boot |
| Automatic (Delayed Start) | Starts shortly after boot |
| Manual | Starts when needed |
| Disabled | Cannot start |
Examples:
Windows Boots
↓
Automatic Service Starts
Service Accounts
Services execute under identities known as service accounts.
Common examples include:
| Account | Purpose |
|---|---|
| SYSTEM | Full local privileges |
| LOCAL SERVICE | Limited local privileges |
| NETWORK SERVICE | Limited privileges with network access |
Example:
Service
↓
Runs As
↓
SYSTEM
The service inherits the permissions and privileges associated with that identity.
Service Control Manager (SCM)
Windows manages services through a component known as the:
Service Control Manager
Commonly abbreviated:
SCM
Conceptually:
Windows
↓
SCM
↓
Services
The SCM is responsible for:
- Starting services
- Stopping services
- Monitoring services
- Managing service configuration
Viewing Services
PowerShell:
Get-Service
Command Prompt:
sc query
Example:
Status Name DisplayName
------ ---- -----------
Running EventLog Windows Event Log
Running WinDefend Microsoft Defender
Running WinRM Windows Remote Management
Service States
Services can exist in various states.
Common examples:
| State | Meaning |
|---|---|
| Running | Currently active |
| Stopped | Not running |
| Paused | Temporarily suspended |
Starting and Stopping Services
Services can be controlled manually.
PowerShell:
Start-Service WinRM
Stop-Service WinRM
Command Prompt:
sc start WinRM
sc stop WinRM
Administrative privileges are often required.
Service Configuration
Services have associated configuration information.
Examples include:
- Service Name
- Startup Type
- Executable Path
- Service Account
- Dependencies
PowerShell:
Get-CimInstance Win32_Service
Example:
Service Name: WinRM
Startup Type: Automatic
Account: Network Service
Path: C:\Windows\System32\svchost.exe
Service Dependencies
Some services require other services to function.
Example:
Service A
↓
Depends On
↓
Service B
Security Considerations
Services are important security targets.
Questions operators commonly ask include:
- Which services run as SYSTEM?
- Which services start automatically?
- Which services are unnecessary?
- Which services expose network access?
- Which services appear unusual?
Service misconfigurations have historically been a common source of privilege escalation.
Operator Perspective
When approaching an unfamiliar Windows system, Operators typically ask:
Inventory
- What services exist?
- Which services are running?
Identity
- Which account runs the service?
- Does it run as SYSTEM?
Configuration
- What executable does the service launch?
- What startup type is configured?
Security
- Does the service expose network functionality?
- Does the service have excessive privileges?
- Does the service appear unusual?
Investigation
- Was a service recently installed?
- Was a service recently modified?
- Is malware masquerading as a service?
Many investigations eventually involve service analysis.
Key Takeaways
- Services provide background functionality.
- Services can operate without user interaction.
- Every service ultimately executes within one or more processes.
- Services can start automatically, manually, or remain disabled.
- Services execute under service accounts.
- The Service Control Manager (SCM) manages services.
- Services can be viewed, started, and stopped.
- Services often depend on other services.
- Service misconfigurations can create security risks.
- Understanding services is essential for both offensive and defensive operations.
The next lesson explores Scheduled Tasks and how Windows performs automated actions.