Windows service troubleshooting: accounts, dependencies and activation

Start DC01 and SRV01. Work as SAATLAB\adm.rahul in PowerShell as administrator on SRV01.

1Find Automatic services that are not running

On SRV01:

Get-CimInstance Win32_Service -Filter "StartMode='Auto' AND State<>'Running'" |
    Select-Object Name, State, ExitCode, DelayedAutoStart | Format-Table

You’ll see something like this:

Name       State   ExitCode DelayedAutoStart
----       -----   -------- ----------------
gpsvc      Stopped        0 False
MapsBroker Stopped        0 True
sppsvc     Stopped        0 True
WbioSrvc   Stopped     1077 False

Not every stopped Automatic service is a problem. Some start, do their job and stop (sppsvc), some are trigger-started, and some have nothing to do on a server. Exit code 0 is normal.

A non-zero exit code on a service you need is what you chase.

✅ Checkpoint: You have a list of Automatic services that aren’t running, with their exit codes.

2Read account, triggers and dependencies

On SRV01, look at the web service:

sc.exe qc W3SVC
Get-Service W3SVC -RequiredServices | Select-Object Name, Status, StartType

You’ll see something like this:

[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: W3SVC
        TYPE               : 20  WIN32_SHARE_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Windows\system32\svchost.exe -k iissvcs
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : World Wide Web Publishing Service
        DEPENDENCIES       : WAS
                           : HTTP
        SERVICE_START_NAME : LocalSystem

Name Status  StartType
---- ------  ---------
HTTP Running Manual
WAS  Running Manual

W3SVC runs as LocalSystem inside a shared svchost, and it can’t start unless WAS and HTTP start first. Dependencies set to Manual are fine: the Service Control Manager starts them when W3SVC needs them. Disabled is not fine, as you’ll see in the Break It lab.

✅ Checkpoint: You can read a service’s start type, binary path, account and dependencies.

3Map services to processes

On SRV01:

$s = Get-CimInstance Win32_Service -Filter "Name='W3SVC'"
$s.ProcessId
tasklist /svc /fi "PID eq $($s.ProcessId)"

You’ll see something like this:

3184

Image Name                     PID Services
========================= ======== ============================================
svchost.exe                   3184 W3SVC, WAS

W3SVC and WAS share one process. If you kill that process to “restart IIS”, you stop both, and anything else in it. Restart services with Restart-Service instead, and use this mapping when one svchost uses a lot of CPU or memory.

✅ Checkpoint: You know which process hosts W3SVC and which other services share it.

4Read recent service errors

On SRV01, list Service Control Manager errors from the last 7 days:

Get-WinEvent -FilterHashtable @{ LogName = 'System'; ProviderName = 'Service Control Manager'; Level = 2; StartTime = (Get-Date).AddDays(-7) } -ErrorAction SilentlyContinue |
    Group-Object Id | Select-Object Name, Count,
        @{ n = 'Latest'; e = { (($_.Group | Sort-Object TimeCreated)[-1].Message -split "\r?\n")[0] } } | Format-Table -Wrap

You’ll see something like this:

Name Count Latest
---- ----- ------
7031     1 The Print Spooler service terminated unexpectedly.  It has done this 1 time(s).  The following
           corrective action will be taken in 60000 milliseconds: Restart the service.
7034     1 The World Wide Web Publishing Service service terminated unexpectedly.  It has done this 1 time(s).

Grouping by event ID shows patterns fast: one crash is noise, the same crash every night is a ticket. Your results depend on what you broke in earlier lessons.

✅ Checkpoint: You can list and group service errors by event ID.

5Check activation and the KMS record

On SRV01:

cscript //nologo C:\Windows\System32\slmgr.vbs /dlv | Select-String 'Name:|License Status|activation expiration'
Resolve-DnsName _vlmcs._tcp.saatlab.internal -Type SRV

You’ll see something like this:

Name: Windows(R), ServerDatacenterEval edition
License Status: Licensed
Timebased activation expiration: 205920 minute(s) (143 day(s))

Resolve-DnsName : _vlmcs._tcp.saatlab.internal : DNS name does not exist

The lab uses evaluation copies, so there’s no KMS host and no _vlmcs record. In a company with KMS, that missing record is exactly what causes 0x8007232B, and an old record pointing to a dead host causes 0xC004F074. Next you’d test Test-NetConnection kms-host -Port 1688 and check time with w32tm /query /status.

✅ Checkpoint: slmgr shows the license status, and you know which DNS record KMS clients look for.