Services Windows en profondeur¶

Ce que vous allez apprendre¶

• Ou et comment chaque service est enregistre dans le registre
• La signification de chaque valeur du registre d'un service : Start, Type, ErrorControl, ImagePath, et bien d'autres
• Les types de demarrage (0 a 4) avec des exemples concrets
• Les types de services : pilotes noyau, processus, processus partage
• Le systeme de dependances entre services
• Les options de recuperation : FailureActions, FailureCommand, ResetPeriod
• Les services proteges (PPL) et LaunchProtected
• Les comptes de service : LocalSystem, LocalService, NetworkService, gMSA
• Comment creer un service directement dans le registre
• Les pilotes noyau vs les services utilisateur
• Les services a declenchement (Trigger-Started Services)
• Le depannage de services qui refusent de demarrer

Anatomie d'un service dans le registre¶

Chaque service Windows est un ensemble de valeurs sous :

HKLM\SYSTEM\CurrentControlSet\Services\{nom-du-service}

Regardons un service concret :

Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\Spooler"

DisplayName     : @%systemroot%\system32\spoolsv.exe,-1
Description     : @%systemroot%\system32\spoolsv.exe,-2
ErrorControl    : 1
FailureActions  : {128, 81, 1, 0...}
Group           :
ImagePath       : %SystemRoot%\System32\spoolsv.exe
ObjectName      : LocalSystem
RequiredPrivileges : {SeTcbPrivilege, SeImpersonatePrivilege, SeAuditPrivilege...}
ServiceSidType  : 1
Start           : 2
Type            : 16
DependOnService : {RPCSS, http}

Toutes les valeurs d'un service¶

Valeurs fondamentales¶

Valeurs de dependances¶

Valeurs de recuperation¶

Valeurs avancees¶

Types de demarrage (Start)¶

La valeur Start determine quand le service ou le pilote est charge.

graph LR
    subgraph "Phase 1 : Demarrage"
        S0["Start = 0<br/>Boot"]
        S1["Start = 1<br/>Systeme"]
    end
    subgraph "Phase 2 : Apres connexion"
        S2["Start = 2<br/>Automatique"]
        S2D["Start = 2<br/>+ DelayedAutostart<br/>Automatique (differe)"]
    end
    subgraph "Phase 3 : A la demande"
        S3["Start = 3<br/>Manuel"]
    end
    subgraph "Jamais"
        S4["Start = 4<br/>Desactive"]
    end

    S0 --> S1 --> S2 --> S2D --> S3
    S4 -.->|"ne demarre pas"| S4

Exemples concrets pour chaque type¶

# Disk driver — loaded by the boot loader itself
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\disk" |
    Select-Object DisplayName, Start, Type, Group

DisplayName : Disk Driver
Start       : 0
Type        : 1
Group       : SCSI Class

# TCP/IP stack — loaded by the kernel during init
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip" |
    Select-Object DisplayName, Start, Type, Group

DisplayName : TCP/IP Protocol Driver
Start       : 1
Type        : 1
Group       : PNP_TDI

# Print Spooler — started automatically after logon
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\Spooler" |
    Select-Object DisplayName, Start, Type

DisplayName : @%systemroot%\system32\spoolsv.exe,-1
Start       : 2
Type        : 16

# WebClient — started only when needed
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\WebClient" |
    Select-Object DisplayName, Start, Type

DisplayName : WebClient
Start       : 3
Type        : 32

# Example: a disabled service
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\RemoteRegistry" |
    Select-Object DisplayName, Start, Type

DisplayName : @%SystemRoot%\system32\regsvc.dll,-1
Start       : 4
Type        : 32

Types de services (Type)¶

# See which services share a svchost group
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\AudioSrv" |
    Select-Object DisplayName, Type, ImagePath

DisplayName : Windows Audio
Type        : 32
ImagePath   : %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted -p

Le parametre -k LocalServiceNetworkRestricted indique le groupe svchost, et -p active le SID de processus (isolation).

Niveaux de controle d'erreur (ErrorControl)¶

Que fait Windows si un service ou un pilote echoue au demarrage ?

graph TD
    E0["ErrorControl = 0<br/>Ignore"]
    E1["ErrorControl = 1<br/>Normal"]
    E2["ErrorControl = 2<br/>Severe"]
    E3["ErrorControl = 3<br/>Critical"]

    E0 -->|"Le demarrage continue"| OK["Demarrage normal"]
    E1 -->|"Journalise l'erreur"| OK
    E2 -->|"Bascule vers LastKnownGood"| LKG["Essaie avec ControlSet sain"]
    E3 -->|"LastKnownGood echoue aussi"| BSOD["STOP / Ecran bleu"]

Dependances de services¶

DependOnService¶

Un service ne demarre que si tous les services listes dans DependOnService sont deja en cours d'execution.

(Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\Spooler").DependOnService

RPCSS
http

Le Spooler d'impression a besoin de RPCSS (Remote Procedure Call) et de HTTP (HTTP.sys).

DependOnGroup¶

Le service demarre si au moins un service du groupe est en cours d'execution.

(Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation").DependOnGroup

NetworkProvider

Groupes de chargement et ServiceGroupOrder¶

Les services ayant une valeur Group sont charges dans l'ordre defini par :

(Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder").List[0..15]

System Reserved
EMS
WdfLoadGroup
Boot Bus Extender
System Bus Extender
SCSI miniport
Port
Primary Disk
SCSI Class
SCSI CDROM Class
FSFilter Infrastructure
FSFilter System
FSFilter Bottom
FSFilter Copy Protection
FSFilter Security Enhancer
FSFilter Open

sc qc Spooler
sc EnumDepend Spooler

SERVICE_NAME: Fax
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 1077  (0x435)

Diagramme de dependances typique¶

graph BT
    RPC["RpcSs<br/><small>Remote Procedure Call</small>"]
    DCOM["DcomLaunch<br/><small>DCOM Server</small>"]
    HTTP["HTTP<br/><small>HTTP.sys</small>"]
    SPL["Spooler<br/><small>Impression</small>"]
    FAX["Fax<br/><small>Service de fax</small>"]
    WMI["Winmgmt<br/><small>WMI</small>"]
    NET["LanmanWorkstation<br/><small>Poste de travail</small>"]
    BROWSER["Browser<br/><small>Explorateur d'ordinateur</small>"]

    SPL --> RPC
    SPL --> HTTP
    FAX --> SPL
    WMI --> RPC
    NET --> RPC
    BROWSER --> NET
    DCOM --> RPC

Options de recuperation (FailureActions)¶

Structure binaire de FailureActions¶

La valeur FailureActions est un blob binaire de type REG_BINARY. Voici sa structure :

Chaque action est composee de :

$fa = (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\Spooler").FailureActions
# Reset period (seconds) — first 4 bytes, little-endian
$resetPeriod = [BitConverter]::ToUInt32($fa, 0)
# Number of actions — at offset 0x0C
$actionCount = [BitConverter]::ToUInt32($fa, 12)

Write-Host "Reset period: $resetPeriod seconds"
Write-Host "Number of actions: $actionCount"

# Decode each action (starting at offset 0x10, 8 bytes each)
for ($i = 0; $i -lt $actionCount; $i++) {
    $offset = 16 + ($i * 8)
    $type = [BitConverter]::ToUInt32($fa, $offset)
    $delay = [BitConverter]::ToUInt32($fa, $offset + 4)
    $typeName = switch ($type) {
        0 { "None" }; 1 { "Restart service" }
        2 { "Reboot computer" }; 3 { "Run command" }
    }
    Write-Host "  Failure $($i+1): $typeName (delay: $($delay)ms)"
}

Reset period: 86400 seconds
Number of actions: 3
  Failure 1: Restart service (delay: 60000ms)
  Failure 2: Restart service (delay: 60000ms)
  Failure 3: None (delay: 0ms)

Configurer les actions de recuperation avec sc.exe¶

:: Redemarrer le service au 1er et 2e echec, ne rien faire au 3e
:: Reinitialiser le compteur apres 86400 secondes (24h)
sc failure Spooler reset= 86400 actions= restart/60000/restart/60000//0

[SC] ChangeServiceConfig2 SUCCESS

:: Ajouter une commande a executer au 3e echec
sc failure Spooler reset= 86400 actions= restart/60000/restart/60000/run/120000
sc failureflag Spooler 1
sc description Spooler "Manages print jobs"

[SC] ChangeServiceConfig2 SUCCESS
[SC] ChangeServiceConfig2 SUCCESS
[SC] ChangeServiceConfig2 SUCCESS

FailureActionsOnNonCrashFailures¶

Par defaut, FailureActions ne s'applique que si le service plante (terminaison anormale). Pour appliquer aussi les actions quand le service s'arrete avec un code d'erreur non nul :

sc failureflag Spooler 1

[SC] ChangeServiceConfig2 SUCCESS

Cela positionne la valeur de registre :

FailureActionsOnNonCrashFailures = 1 (REG_DWORD)

Services proteges (PPL — Protected Process Light)¶

Qu'est-ce que PPL ?¶

Certains services critiques sont proteges contre la modification, meme par un administrateur. C'est le mecanisme Protected Process Light (PPL).

Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\WinDefend" |
    Select-Object DisplayName, LaunchProtected

DisplayName     : Windows Defender Antivirus Service
LaunchProtected : 3

Activer PPL pour LSASS¶

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 1 /f

The operation completed successfully.

Redemarrage necessaire. Apres redemarrage :

Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" | Select-Object RunAsPPL

RunAsPPL : 1

Comptes de service¶

Les trois comptes integres¶

gMSA (Group Managed Service Accounts)¶

Les comptes gMSA sont des comptes de domaine Active Directory dont le mot de passe est gere automatiquement.

# Check if a service uses a gMSA
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\MyService" |
    Select-Object ObjectName

ObjectName : DOMAIN\svc-myapp$

Le $ a la fin est la signature d'un compte gMSA.

Comptes virtuels (NT SERVICE)¶

Chaque service a un compte virtuel implicite : NT SERVICE\{nom-du-service}. Ce compte a un SID unique et peut recevoir des permissions sur des fichiers ou des cles de registre.

# Granting a virtual account access to a folder
$acl = Get-Acl "C:\ServiceData"
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
    "NT SERVICE\MyService", "FullControl", "Allow"
)
$acl.SetAccessRule($rule)
Set-Acl "C:\ServiceData" $acl

Aucune sortie si la commande reussit. Un message d'erreur apparait en cas de probleme.

Creer un service via le registre¶

Methode manuelle pas a pas¶

:: Step 1: Create the service key
reg add "HKLM\SYSTEM\CurrentControlSet\Services\MyCustomSvc" /f

:: Step 2: Set the mandatory values
reg add "HKLM\SYSTEM\CurrentControlSet\Services\MyCustomSvc" /v DisplayName /t REG_SZ /d "My Custom Service" /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\MyCustomSvc" /v Description /t REG_SZ /d "A custom service for demonstration" /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\MyCustomSvc" /v ImagePath /t REG_EXPAND_SZ /d "%%SystemRoot%%\System32\myservice.exe" /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\MyCustomSvc" /v Start /t REG_DWORD /d 3 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\MyCustomSvc" /v Type /t REG_DWORD /d 16 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\MyCustomSvc" /v ErrorControl /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\MyCustomSvc" /v ObjectName /t REG_SZ /d "LocalSystem" /f

The operation completed successfully.
The operation completed successfully.
The operation completed successfully.
The operation completed successfully.
The operation completed successfully.
The operation completed successfully.
The operation completed successfully.
The operation completed successfully.

Methode recommandee : sc.exe¶

sc create MyCustomSvc binPath= "%SystemRoot%\System32\myservice.exe" type= own start= demand DisplayName= "My Custom Service"
sc description MyCustomSvc "A custom service for demonstration"

[SC] CreateService SUCCESS
[SC] ChangeServiceConfig2 SUCCESS

Methode PowerShell¶

New-Service -Name "MyCustomSvc" `
    -BinaryPathName "$env:SystemRoot\System32\myservice.exe" `
    -DisplayName "My Custom Service" `
    -Description "A custom service for demonstration" `
    -StartupType Manual

Status   Name               DisplayName
------   ----               -----------
Stopped  MyCustomSvc        My Custom Service

Pilotes noyau vs services utilisateur¶

Les pilotes sont enregistres dans le meme emplacement que les services (HKLM\SYSTEM\CurrentControlSet\Services), mais ils ont des differences fondamentales.

# Compare a user-mode service and a kernel driver
$svc = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\Spooler" |
    Select-Object @{N='Name';E={'Spooler'}}, Type, Start, ImagePath
$drv = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\NTFS" |
    Select-Object @{N='Name';E={'NTFS'}}, Type, Start, ImagePath

$svc, $drv | Format-Table -AutoSize

Name    Type Start ImagePath
----    ---- ----- ---------
Spooler   16     2 %SystemRoot%\System32\spoolsv.exe
NTFS       2     1

Services a declenchement (Trigger-Started Services)¶

Depuis Windows 7, certains services demarrent en reaction a un evenement systeme plutot qu'au demarrage.

Types de declencheurs¶

Ou sont stockes les declencheurs ?¶

HKLM\SYSTEM\CurrentControlSet\Services\{nom}\TriggerInfo

Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Services\ShellHWDetection\TriggerInfo" -ErrorAction SilentlyContinue

    Hive: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ShellHWDetection\TriggerInfo

Name                           Property
----                           --------
0                              Type     : 1
                               Action   : 1
                               GUID     : {53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Configurer un declencheur via sc.exe¶

:: Start service when a USB device is plugged in
sc triggerinfo ShellHWDetection start/deviceinterface/{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

[SC] ChangeServiceConfig2 SUCCESS

:: View current triggers
sc qtriggerinfo ShellHWDetection

[SC] QueryServiceConfig2 SUCCESS

SERVICE_NAME: ShellHWDetection

        START SERVICE
          DEVICE INTERFACE ARRIVAL  : 53f56307-b6bf-11d0-94f2-00a0c91efb8b [VOLUME DEVICE INTERFACE CLASS]

Gestion des services : commandes de reference¶

sc.exe¶

sc qc Spooler

[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Spooler
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : %SystemRoot%\System32\spoolsv.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Print Spooler
        DEPENDENCIES       : RPCSS
                           : http
        SERVICE_START_NAME : LocalSystem

sc query Spooler

SERVICE_NAME: Spooler
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

sc start Spooler
sc stop Spooler

Aucune sortie si la commande reussit. Le service demarre ou s'arrete.
Un message d'erreur apparait si le service est deja dans l'etat demande.

:: Passer en demarrage automatique
sc config Spooler start= auto

:: Passer en demarrage automatique differe
sc config Spooler start= delayed-auto

:: Desactiver
sc config Spooler start= disabled

[SC] ChangeServiceConfig SUCCESS

PowerShell¶

Get-Service | Where-Object { $_.Status -eq "Running" } |
    Sort-Object DisplayName |
    Format-Table Status, Name, DisplayName -AutoSize

Status  Name                   DisplayName
------  ----                   -----------
Running AudioSrv               Windows Audio
Running BFE                    Base Filtering Engine
Running CryptSvc               Cryptographic Services
Running DcomLaunch             DCOM Server Process Launcher
Running Dhcp                   DHCP Client
Running Dnscache               DNS Client
Running EventLog               Windows Event Log
Running LanmanWorkstation      Workstation
Running RpcSs                  Remote Procedure Call (RPC)
Running Spooler                Print Spooler
...

Get-CimInstance Win32_Service -Filter "Name='Spooler'" |
    Format-List Name, DisplayName, State, StartMode, PathName,
        StartName, Description, ProcessId

Name        : Spooler
DisplayName : Print Spooler
State       : Running
StartMode   : Auto
PathName    : %SystemRoot%\System32\spoolsv.exe
StartName   : LocalSystem
Description : Loads files to memory for later printing...
ProcessId   : 2148

Set-Service -Name Spooler -StartupType Automatic
Set-Service -Name Spooler -StartupType Disabled
Set-Service -Name Spooler -StartupType Manual

Aucune sortie si la commande reussit. Un message d'erreur apparait en cas de probleme.

Exemples concrets du monde reel¶

Desactiver les services de telemetrie¶

# List telemetry-related services
$telemetryServices = @(
    "DiagTrack",          # Connected User Experiences and Telemetry
    "dmwappushservice"    # Device Management WAP Push
)

foreach ($svc in $telemetryServices) {
    $current = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\$svc" -ErrorAction SilentlyContinue
    if ($current) {
        Write-Host "$svc : Start = $($current.Start)"
        Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\$svc" -Name "Start" -Value 4
        Write-Host "$svc : now disabled (Start = 4)"
    }
}

DiagTrack : Start = 2
DiagTrack : now disabled (Start = 4)
dmwappushservice : Start = 3
dmwappushservice : now disabled (Start = 4)

Configurer les options de recuperation de Windows Update¶

sc failure wuauserv reset= 86400 actions= restart/120000/restart/300000/restart/600000
sc failureflag wuauserv 1

[SC] ChangeServiceConfig2 SUCCESS
[SC] ChangeServiceConfig2 SUCCESS

Cela configure : redemarrer apres 2 min au 1er echec, 5 min au 2e, 10 min au 3e, avec reinitialisation du compteur toutes les 24h.

Depannage des services¶

Le service ne demarre pas¶

graph TD
    A["Le service ne demarre pas"] --> B{"Quel code d'erreur ?"}
    B -->|"1053 — Timeout"| C["Augmenter le timeout<br/><small>ServicesPipeTimeout</small>"]
    B -->|"1068 — Dependance"| D["Verifier DependOnService<br/><small>et demarrer les dependances</small>"]
    B -->|"1069 — Echec logon"| E["Verifier ObjectName<br/><small>et le mot de passe</small>"]
    B -->|"2 — Fichier introuvable"| F["Verifier ImagePath<br/><small>le chemin est-il correct ?</small>"]
    B -->|"5 — Acces refuse"| G["Verifier les permissions<br/><small>du compte de service</small>"]

Augmenter le timeout de demarrage global¶

Si de nombreux services echouent avec le code 1053 :

reg add "HKLM\SYSTEM\CurrentControlSet\Control" /v ServicesPipeTimeout /t REG_DWORD /d 120000 /f

The operation completed successfully.

La valeur est en millisecondes (120 000 = 2 minutes au lieu des 30 secondes par defaut).

Verifier la chaine de dependances¶

function Get-ServiceDependencyTree {
    param([string]$ServiceName, [int]$Indent = 0)
    $svc = Get-Service $ServiceName -ErrorAction SilentlyContinue
    if (-not $svc) { return }

    $prefix = "  " * $Indent
    $status = $svc.Status
    Write-Host "$prefix[$status] $($svc.Name) ($($svc.DisplayName))"

    foreach ($dep in $svc.ServicesDependedOn) {
        Get-ServiceDependencyTree -ServiceName $dep.Name -Indent ($Indent + 1)
    }
}

Get-ServiceDependencyTree -ServiceName "Spooler"

[Running] Spooler (Print Spooler)
  [Running] RpcSs (Remote Procedure Call (RPC))
    [Running] DcomLaunch (DCOM Server Process Launcher)
  [Running] HTTP (HTTP Service)

Service bloque en etat "Stopping"¶

:: Find the PID of the stuck service
sc queryex Spooler

SERVICE_NAME: Spooler
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 3  STOP_PENDING
                                (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x3
        WAIT_HINT          : 0x4e20
        PID                : 2148
        FLAGS              :

:: Force-kill the process
taskkill /PID 2148 /F

SUCCESS: The process with PID 2148 has been terminated.