1

While running the Services.msc GUI offers the ability to manually set a Windows service start type to Automatic, Automatic (Delayed start), Manual, or Disabled, the configuration of services is stored in a Registry tree that can be configured via the command shell and registry editor.

When using sc config or regedit, the options for service start type are 0, 1, 2, 3, and 4, which correspond to Boot, System, Automatic, Manual, and Disabled. Boot and System are now configurable options. Changing an arbitrary service's start value data to 0 does make Services.msc reflect "Boot" in the Startup Type column (although attempting to edit that service startup type through the GUI only provides the regular four options).

It seems that Boot and System are useful additional options, yet apparently few or none of the default Windows services take advantage of it - not even Windows components that seem pretty integral like Power, Windows Defender Advanced Threat Protection, or Cryptographic Services.

So my question(s) are:

  • Is it safe to set services to start at Boot or System if they are desired to run even earlier than Automatic services?
  • Will doing so cause system instability? (And if the answer is "it depends," please point to some documentation that provides a rationale, and ideally that could be used to determine which services, if any, are safe and stable to do this to.)
  • Are there any specific reasons it is not recommended to use these start options?
  • Is there any actual Microsoft documentation of the purpose/uses of these start options? (I haven't found any so far.)
2
  • 1
    From what I remember, those are meant for use by drivers, not services? The two share the configuration. Nov 1, 2023 at 22:44
  • That would make a lot of sense. That being said, is there any way to know (besides just trying it with fingers crossed) what would happen if a service were configured with Boot or System? Do you think they would actually start earlier, or not start at all, or ignore it and just start automatically, or make the computer catch fire...?
    – ETL
    Nov 2, 2023 at 2:37

1 Answer 1

2

The Service Control Manager (SCM) - services.exe, is responsible for managing Windows services. In this context, services include user-mode services (.exe) and kernel mode drivers (.sys).

User mode services can be implemented as DLLs also, but need to be hosted by a ".exe" process, which is the case for many services hosted by svchost.exe.

The database of services is stored under the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

In order to register a new service with the SCM or control a service, a number of APIs are available. See https://learn.microsoft.com/en-us/windows/win32/api/winsvc/

If you look at the documentation for configuring a service, using the API ChangeServiceConfigW, which would include setting the start type we see:

SERVICE_BOOT_START   - 0x00000000 - A device driver started by the system loader. This value is valid only for driver services.
SERVICE_SYSTEM_START - 0x00000001 - A device driver started by the IoInitSystem function. This value is valid only for driver services.

So these start types (0 and 1) are for drivers, not user-mode services. The MMC snap-in Services.msc only displays user-mode services, not drivers.

I hope this helps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .