I have recently installed a program that deploys an agent which "protects" from peripherals. What it actually does at this point is to block any kind of media I plug to my PC.

I've done some checking and I found the name of this service blocking my peripherals. So, naturally, I've tried stopping it.

First I tried the sc stop, but I was denied the access. Trying to do it by services.msc will result in not even giving me the priviledge to use stop on that service. Same response from taskkill: Access denied... Then I figured I'd try net stop resulting with the 2191 message which if I try net helpmsg 2191 does not give any information. I then decided to surf Superuser and found out about these pstools. But as soon as I try to do the cmd switch with psexec -s cmd I get the message:

Couldn't install PsExec service: access is denied.

Strangely, if I try to use just psexec it does prompt me with the help info. So this was a dead end again.

After all these fails I have decided to just remove it from startup right? So I open msconfig and remove the service from startup, save and finally reboot. Unfortunately, when PC reboots so does the service. By the time I can access the task manager the service is already running, again. Can't really imagine how though.

All these access failures made me think I might not have the required privileges or something, but my user account is set as administrator so I think there's nothing more I can do.

  • 8
    I love the title of this question: "UNSTOPPABLE" windows service. Gotta love windows. – Musaab Sep 22 '11 at 9:49
  • 1
    is it possible that this service is restarting based on the task scheduler? if i say something stupid , just tell me somthing smart instead, i am new to 7 and i need to lear some of these same things. – Psycogeek Sep 23 '11 at 1:12

Many security software installs a special driver that intercepts any changes to its services and processes.

However, the driver is normally not loaded in Safe Mode, so you can disable the service there. If the service is still started after reboot, you may want to find and disable the driver in Device Manager. This kind of driver is normally under the "Non-plug and play drivers" section which is viewable by selecting "Show hidden devices" from the View menu. The name of the driver is normally well-known for each provider.

| improve this answer | |

What about opening regedit.exe and go to

HKLM\SYSTEM\CurrentControlSet\services\[service name]

Than change the service to disable (I think you can do that by changing the "Start" value to 4).

The valid service Start types are:

  • SERVICE_BOOT_START (0): A device driver started by the system loader. This value is valid only for driver services.
  • SERVICE_SYSTEM_START (1): A device driver started by the IoInitSystem function. This value is valid only for driver services.
  • SERVICE_AUTO_START (2): A service started automatically by the service control manager during system startup. For more information, see Automatically Starting Services.
  • SERVICE_DEMAND_START (3): A service started by the service control manager when a process calls the StartService function. For more information, see Starting Services on Demand.
  • SERVICE_DISABLED (4): A service that cannot be started. Attempts to start the service result in the error code ERROR_SERVICE_DISABLED.
| improve this answer | |
  • 1
    Doesn't allow to change that as well. – Piyush Soni Apr 27 '16 at 13:47
  • 1
    @PiyushSoni Then you should take ownership of that registry with SetAcl. – Biswapriyo Sep 9 '17 at 3:29
  • @Biswapriyo How safe is that though? A corrupt workstation can be a bit of a setback. – samis May 2 '18 at 20:51

Use taskkill command followed by the service's process ID. This will kill the service.

| improve this answer | |
  • 4
    ERROR: The process with PID 3516 could not be terminated. Reason: Access is denied. – FracturedRetina Jul 15 '14 at 1:29
  • 3
    Run the command prompt as administrator and run taskkill /F /PID <pid> and it works. – Muhd Jul 25 '15 at 18:35
  • 2
    Nope. In some cases (such as the one I'm dealing with) that is not sufficient. I have run cmd as Administrator and am still getting the access denied error message. – iX3 Aug 28 '15 at 4:20

Have you tried opening Services.msc as an administrator or running an elevated command prompt? This should give you the required permissions to stop the task.

| improve this answer | |
  • 2
    Running services.msc under administrator does not seem to make any difference. Why would and elevated command promt work and which one do you recommend ? – Calin Paul Alexandru Sep 22 '11 at 9:22
  • The other thing to do would be to find what the permissions are on the task you are trying to kill. It may only let certain users terminate the process. Built in to protect it. – Joe Taylor Sep 22 '11 at 9:31
  • Ok, but I'm alreay an administrator, what kind of user can have some privs that an administrator does not? Also the task is flagged as unpausable, unspoppable but accepts shutdown. I don't really know how to "shutdown" a service and google does seem to help on this one. – Calin Paul Alexandru Sep 22 '11 at 9:35
  • thinking it runs in the AV sandbox. – RobotHumans Sep 22 '11 at 9:37
  • Some tasks require the command prompt to be run as an administrator even though the user is an administrator. They simply won't work without. Have you checked the security settings on the process that is running? You may need to be a member of a certain group to kill the process. Certain AV's use this for protection. – Joe Taylor Sep 22 '11 at 9:38

Autoruns run in administrator let you disable services at startup.

| improve this answer | |

It could be a permission issue.

Click on Start, Services, shift + right click on Services, Run as Administrator or Run as a Different User.

| improve this answer | |
  1. Boot into linux, mount the windows partition, load the registry hive and disable the service through the registry.

  2. If that doesn't work, just delete or rename the EXE file that the service starts.

| improve this answer | |

Some services do not accept SERVICE_ACCEPT_STOP messages, by the time it was developed. And that is hard coded into the executable. Period. A workaround would be not to have it started, and as you cannot change its properties, forcibly do the following:

  1. Boot into safe mode (Windows 10 users might need msconfig > boot > safe boot)
  2. Regedit into HKLM > System > ControlSet001 > Services
  3. Locate your service entry
  4. Change 'Start' key to 3 (manual startup) or 4 (disabled)

If you cannot change the entry, right-click on your service name on the left pane, select 'Permissions', check that 'Everyone' has full access and try step 4 again.

Don't forget to disable safe boot from msconfig again, and reboot !

| improve this answer | |

Boot into safe mode. Click start. type services disable EDPA and WDP services

in program files (x86) - delete manufacture folder.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.