Do windows services log why they wont start? - windows

I have a windows service that will not start on a brand new windows server 2012 installation.
When I attempt to start the service, I get this error.
The Foobar service on Local Computer started and then stopped. Some services stop automatically if they are not in use by other services or programs.
I come from a linux background, and don't use windows much. In my troubleshooting attempts, I have been able to gather the following logs.
The requested Performance Counter is not a custom counter, it has to be initialized as ReadOnly.\u000d\u000a at System.Diagnostics.PerformanceCounter.InitializeImpl()\u000d\u000a at System.Diagnostics.PerformanceCounter..ctor(String categoryName, String counterName, String instanceName, Boolean readOnly)\u000d\u000a at System.Diagnostics.PerformanceCounter..ctor(String categoryName, String counterName, Boolean readOnly)\u000d\u000a at foobar.sage.OnStart(String[]
Things that I have tried from the front page of google.
https://stackoverflow.com/a/2081976/1626687
PS C:\Users\sowen> lodctr C:\Windows\Microsoft.NET\Framework\v4.0.30319\CORPerfMonExt.dll
PS C:\Users\sowen> lodctr C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CORPerfMonExt.dll
https://stackoverflow.com/a/14513897/1626687
PS C:\Users\sowen> unlodctr .NETFramework
Removing counter names and explain text for .NETFramework
Updating text for language 009PS
PS C:\Users\sowen> lodctr 'C:\Windows\Inf\.NETFramework\corperfmonsymbols.ini'
https://social.technet.microsoft.com/Forums/windowsserver/en-US/46a21b31-f5fc-4a44-bd4c-c9884a923943/performance-monitor-in-windows-server-2012
Modify HKLM/\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
Disable Performance Counters = 0
loadctl /r
None of these attempts have resolved the issue. Is there a place where windows shows additional logging why this service wont start?

There doesn't appear to be much more you can do for logging besides looking at the event viewer.
I finally got this running by using InstallUtil instead of sc.exe
sc.exe create foobar obj= "example.com\\someuser" password= "correct-horse-battery-staple" binPath= c:\foobar.exe start= auto depends= "MSMQ"
sc.exe delete foobar
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /user="example.com\someuser" /password="correct-horse-battery-staple" c:\foobar.exe

Related

Windows Process Activation Service (WAS) will not start

IIS 10 will not restart on my PC. When I navigate to localhost, I get a 'localhost refused to connect' message. After looking through the event viewer, it turns out that the issue is that the Windows Process Activation Service (WAS) will not start.
The error message given is:
'The Windows Process Activation Service (WAS) encountered an error while handling key generation. This will prevent WAS from starting corrently. The data field contains the error number.'
When I try to start the service manually from the services app, I get the following:
Has anyone experienced this issue before? Any help would be greatly appreciated, I've been trawling the internet for several days trying to find a solution to no avail.
We've run into this issue several times after recent Windows Updates. In all cases, the following worked (got from a Microsoft support rep):
Run the following from an admin Powershell prompt:
reg delete HKLM\SYSTEM\CurrentControlSet\Services\WAS\Parameters /v GenerateKeys /f
net start w3svc
The keys will be regenerated, then the IIS AppPools can be started
According to your error message, WAS can not access the machine key when start up. Usually, machine keys are used to encrypt sensitive information in config file, WAS will not be able to start if there is no machine key to use.
The easiest and most common method is to try to uninstall and reinstall WAS.
If it still can not start, try to delete the registry entry NanoSet with cmd.
If the above two methods are useless, you can refer to this to delete machine keys, let WAS create new one while starting.
If somebody is still fighting with this issue, please check Event Viewer under System filter and check for any logs related to WAS. In my case I found the following entry:
The Windows Process Activation Service (WAS) encountered an error while handling key generation. This will prevent WAS from starting currently. The data field contains the error number.
So I just started again CNG Key Isolation service and everything is working now.

Creating service with short Name and DisplayName breaks WMI for services

Lately I was having problem with WMI on one of the systems (win server 2019). Service list in Task Manager was empty and running Get-WmiObject Win32_Service from powershell was returning Generic failure. After fruitless hours of searching and trying to repair system I gave up and was ready to reinstall system. Then error was reproduced on another machine by accident and I was able to narrow down cause of the problem. After creating windows service with short name and short display name WMI brakes after system restart but only if that service is first (in alphanumeric order) on services list. To reproduce this effect you only need to run
sc create "A1" binpath="D:\foobar.exe" DisplayName="A1" start=disabled
binpath is irrelevant, service doesn't need to be started. DisplayName doesn't need to be identical to name. After that command you need to restart (before restart everything works). After that if you go to services list in task manager it will be empty (probably using WMI to query services list). Now you can run sc delete "A1" and reopen task manager. Everything is back to normal.
Problem was reproduced on Windows Server 2019 and Windows 10 (didn't tried on other versions).
Is this a known bug or what is happening here?
EDIT
I'm not asking about how to use sc. It's doesn't matter. I provided commands that someone can run to reproduce problem. You can create service with that parameters however you want.
You are using the sc command line arguments in the incorrect format.
From MSDN:
Optionvalue
Specifies the value for the parameter named by Optionname. See the Optionname reference for a list of supported values. When a string is to be input, the use of empty quotes means that an empty string is passed in. Note that there is a space between OptionValue and the equal sign.
The correct command should be:
sc create "A1" binpath= "D:\foobar.exe" DisplayName= "A1" start= disabled

sc.exe alternative to find deactivated Windows service?

I use sc.exe to stop/start services on a remote \server in a pre/post build batch. Unfortunately sc does not seem to deliver any information about the service being deactivated or not which leads to an accumulating timeout when using the sc start command on deactivated services. Does anyone know an alternative to check the deactivated state on a remote service in the command line?
This is what you are looking for..
How to test whether a service is running from the command line
look down for the WMI/WMIC options. You will need to modify the command line slightly to attach to a remote machine.
If you need to know the start mode property, add it to the command line like this:
wmic /locale:ms_409 service where (name="RemoteRegistry") get state, StartMode /Value
This produces:
StartMode=Disabled
State=Stopped
I am not marking as duplicate because your wording and needs are a little bit different.

Can a Windows service install another Windows service?

I am having trouble when I have one Windows service try to install another Windows service.
Specifically, I have a TeamCity agent running tests for me on a Windows 2008 AWS instance. The tests are written in Java, which shell out to a .bat script to install a service (let's call it Service A), giving it a unique name each time.
The offending line is in the .bat script: sc create "%serviceName%" binPath= %binPath% DisplayName= "%serviceDisplayName:"=%" start= %serviceStartType%. I believe as long as the service name is unique that should work.
And indeed it does work if I run the tests manually on the command line, using an administrator account. Service A is installed, the test completes and Service A is uninstalled at the end.
I have tried running the TeamCity agent as LocalSystem, as Administrator, and as another user that is member of the administrators group. I have also tried disabling UAC completely.
Presumably the problem is access denied type errors, although that is not clear at this point. There are a few avenues to explore still, but it is a simple question really: are processes running as services forbidden from installing other services? Are there special things I have to do to configure the machine/ account to allow it to do this?
The point of the test it to install and use Service A, so workarounds are not relevant - Service A must be operated as a black box.
Thanks!
There are no restrictions on creating services with regards to how the creating process can execute, as long as the process has the appropriate permissions. That is to say, a process could be running as a service and create another service -- the only consideration here is the appropriate permission level.
The problem that often occurs with running batch scripts from within processes (as opposed to directly through user input on the command line) is that the environment expected isn't always the environment that is loaded. In this case, it appears that the env variables referred to in the batch script weren't properly set when running as a service, which of course then caused the service install failure. Correcting the environment loaded when the batch script is shelled out is the correct solution here.

Cannot delete windows 7 service

I have a service called "A B C". Now I am trying to delete the service from cmd in administrator mode:
sc delete "A B C"
but that gives:
C:\>sc delete "A B C"
[SC] OpenService FAILED 1060:
The specified service does not exist as an installed service.
The service is present in the service manager and is set to automatic. How do I delete it?
http://antivirus.about.com/od/securitytips/ht/how-to-delete-windows-service.htm
Since you mentioned that "is set to automatic", it could not be deleted already.
Make sure you have the correct service name. A service can have a service name, and a display name which is different from the former.
If this is a service created by a virus, it is quite possible that OpenService is hooked to keep virus alive, and ordinary method does not work in this situation. Try some anti-virus toolkits, like PsService in Sysinternals Suite or XueTr.
In my case I first tried...
sc delete "MyService Name"
and received error 1072. I had the services window list up looking at all my services. I then tried to close the windows service list and tried to run...
sc delete "MyService Name"
and received error 1062. I opened back up the windows service list and found that the service was gone. It could have been pending removal in the first place but the fact of the matter is I simply had to close the windows service list window.
On a side note, a service name and friendly service name can differ. Make sure you know the real service name! To get the actual service name open windows services list and find the service your interested in, we will call it "My Ugly Service". Then open a command prompt and type the following...
sc GetKeyName "My Ugly Service"
It will return the actual name similar to "MyUglySrv". Then just simply type the following (AFTER YOU CLOSE ALL WINDOWS THAT HAVE THE SERVICE INVOLVED, such as windows services list)...
sc delete "MyUglySrv"
To see both the Display and Service name for both running and stopped services, enter on a command line:
C:\>sc query type= service state= all
Change all to active or inactive to see that particular type of service.
Some folder deleted manually and it create problem sometime,
Re install service again
closed all open folder ,service and task manager
un install services
*if service not delete then just run following with administrator privilege *
run command SC delete postgresql-x64-9.6 (service name )

Resources