Services are often run with default settings — for example, a service might be disabled automatically at startup. You can use the Services snap-in to change the default settings for a service. This is useful if you are troubleshooting service failures or if you need to change the security account under which a service runs.
Membership in Account Operators or Domain Admins, Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review the details in "Additional considerations" in this topic.
Configuring how a service is started
To configure how a service is started using the Windows interface |
-
Click Start, click in the Start Search box, type services.msc, and then press ENTER.
-
Optionally, export and save a list of the existing settings. To do this, right-click Services, select Export List, and save the settings list.
-
In the details pane, right-click the service that you want to configure, and then click Properties.
-
On the General tab, in Startup type, click Automatic, Manual, Disabled, or Automatic (Delayed Start).
-
To specify the user account that the service can use to log on, click the Log On tab, and then do one of the following:
- To specify that the service uses the Local
System account, click Local System account.
- To specify that the service uses the Local
Service account, click This account, and then type
NT AUTHORITY\LocalService.
- To specify that the service uses the Network
Service account, click This account, and then type
NT AUTHORITY\NetworkService.
- To specify another account, click This
account, click Browse, and then specify a user account
in the Select User dialog box. When you are finished, click
OK.
- To specify that the service uses the Local
System account, click Local System account.
-
Type the password for the user account in Password and in Confirm password, and then click OK. If you select the Local Service account or Network Service account, do not type a password.
To configure how a service is started using the command line
- You can also manage services using the sc
config command. For more information about the options
available, open a command prompt and type sc config /?. For
examples and detailed descriptions of the command-line options, see
the command-line reference at http://go.microsoft.com/fwlink/?linkid=53528.
Additional considerations
- To perform this procedure, you must be a
member of the Account Operators group, the Domain Admins group, the
Enterprise Admins group, or you must have been delegated the
appropriate authority. As a security best practice, consider using
Run as to perform this procedure.
- Changing the default service settings might
prevent key services from running correctly. It is especially
important to use caution when changing the Startup Type and
Log On As settings of services that are configured to start
automatically.
- In most cases, we recommend that you do not
change the Allow service to interact with desktop setting.
If you allow the service to interact with the desktop, any
information that the service displays on the desktop will also be
displayed on an interactive user's desktop. A malicious user could
then take control of the service or attack it from the interactive
desktop.
- The Local Service account and Network Service
account are configured with a null password. The password
information you supply is ignored.
- We recommend that user accounts that are used
to log on as a service have the Password never expires check
box selected in their Properties dialog box and that they
have strong passwords.
- If account lockout policy is enabled and the
account is locked out, the service will not start.
- If you enable or disable a service and you
encounter a problem starting the computer, you can start the
computer in Safe Mode. In Safe Mode, core services that are
required to start the operating system are started in a default
scheme, regardless of any changes that are made to the service
settings. After the computer is in Safe Mode, you can change the
service configuration or restore the default configuration.
- If you specify an account that does not have
permission to log on as a service, the Services snap-in
automatically grants the appropriate permissions to that account on
the computer that you are managing.
Additional references
For information about configuring the Windows Time service, see W32tm at http://go.microsoft.com/fwlink/?linkid=69453.
For more information about the user accounts that a service uses to log on, see Default Settings for Services at http://go.microsoft.com/fwlink/?linkid=68107.