Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How can the process/service that started or stopped a service be determined?

For example, I am finding that recently, the Computer Browser, Server, and Workstation services (as well as the function-discovery services) keep starting. I stop them, but then a few minutes later, they are running again. I have already tried disabling things like network shares, NetBIOS, Home Group, and every related thing that I can think of, but this (new) behavior is frustrating, and all the more so because I don’t know what is starting them. If I could figure out what process/service is starting them, then I would at least have a hint of where to look.

No, the Windows Event Log is not helpful because it says nothing about who/what started the service; the most information it gives is that Source field usually says Service Control Manager, but that says nothing about what asked the SC to start/stop the service.

Is there a way to have the Service Controller log state changes or something?

share|improve this question
    
Can I assume that you don't want any networking at all? Also, what version of Windows? I'd expect Windows to log the state changes but I suspect that these services are controlled from the Kernel & I don't suppose Microsoft play fair with these! –  Julian Knight Mar 12 '13 at 19:22
    
Can I assume that you don't want any networking at all? Why? What does LAN/sharing have to do with networking? You don’t need those services to for example browse web pages or P2P or online gaming or… –  Synetech Mar 12 '13 at 22:32
    
More to the point, this question is not about any particular service, it goes for all services. For example, you may want to find out why the Windows Font Cache or Windows Image Acquisition services keep starting so that you can try to prevent whatever is doing it (no, disabling a service is not the solution because not only may you want them to run sometimes, but that only treats the symptom, not the disease; even if they are disabled, something will still be trying to start them). –  Synetech Dec 16 '13 at 19:35
    
The question is about specific services related to Windows networking. The answer may apply to all services. "What does LAN/sharing have to do with networking" - do I really need to answer that? Generally, turning these things off is related to turning off networking in general hence the reason Windows (wrongly) keeps turning them on. –  Julian Knight Dec 18 '13 at 13:33

1 Answer 1

These services are loaded into svchost.exe processes, usually run under the NETWORKSERVICE account. in ProcessExplorer, hover your mouse over a svchosts process to see what services are running under it. if it contains one of your bad services, doubleclick the process and in the properties window, go to the Image tab. the "Autostart location" box shoudl indicate the start method. in my case, the svchost process containing the workstation service starts from HKLM\System\CurrentControlSet\Services\nsi .

also, in the windows services MMC (services.msc), you can see the dependency between services. check to make sure none of your services depend on the services you are shutting down.

also, consider disabling the services in services.msc. if the required service is disabled the depending service should log that a failure to start occured, because a dependency service was not started.

share|improve this answer
    
go to the Image tab. the "Autostart location" box shoudl indicate the start method. Where are you seeing that? I don’t have an Autostart location field in v15.13. you can see the dependency between services Good idea, but none are relevant here (plus it won’t help if a non-service process happens to start it). also, consider disabling the services Actually I had considered that, but didn’t because I’m fairly sure it only logs the failed attempt to start, not the source of the start command. I’ll test it now just in case… –  Synetech Mar 12 '13 at 22:31
    
Well we’re half-way there. I disabled the services in question and found the following error in the Event Log: The Computer Browser service depends on the Server service… That’s great because it points to the Computer Browser service (now have to figure out why the CB service keeps trying to run; I’ll try disabling it to see if I get a descriptive error again). Unfortunately this method only works if the source of the state change is a service, not if it’s another non-service process… –  Synetech Mar 13 '13 at 0:09
    
I'm using v15.3, and running as an administrator. the box appears immediately beneath "Current Directory". –  Frank Thomas Mar 13 '13 at 11:38
    
You don’t mean the Parent field do you? o.O –  Synetech Mar 13 '13 at 19:03
    
I'd send a picture if I could . its above Parent, and below Current Directory. anyway, sorry if it doesn't help you. be sure to run it as admin, in case it only appears to admins. also do you have a copy of autoruns/autorunssc in the same dir as procexp? I do, so they may be symbiotic. –  Frank Thomas Mar 13 '13 at 19:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.