The Core Technologies Blog

Professional Software for Windows Services / 24×7 Operation

Essential Windows Services: Security Center / wscsvc

Posted on July 4, 2022

In this article…

What is the Security Center (wscsvc) service?
Technical information
What happens if I stop Security Center?
Is it OK to disable the Security Center service?
Questions? Problems?

What is the Security Center (wscsvc) service?

The Security Center service is an important “watchdog” focused on protecting your computer.

From the service’s description:

The Security Center service monitors and reports security health settings on the computer.

Those health settings include:

Firewall (on/off)
Antivirus (on/off/out of date)
Antispyware (on/off/out of date)
Windows Update (automatically/manually download and install updates)
User Account Control (on/off)
Internet settings (recommended/not recommended)

In summary, Security Center’s purpose is to let you know when your computer’s defenses are down.

To illustrate how the service works, we turned off the Windows Firewall (which protects your PC from outside attackers). A couple of seconds later, Security Center raised a warning on our desktop, urging us to re-enable the firewall:

Technical information

The service’s name is wscsvc. It runs inside the shared services host process, svchost.exe:

The service’s startup type is Automatic (Delayed Start). As a result, Windows launches the service a couple of minutes after your machine boots.

wscsvc runs in the built-in Local Service account:

What happens if I stop Security Center?

Since Security Center safeguards your machine, stopping the service may leave you in the dark about your computer’s defenses. For that reason, Microsoft has made it very difficult for you to stop the Security Center service.

In fact, not even members of the powerful Administrators group can stop (or change) the service! If you open the Services application, you will notice that all the command buttons are disabled:

Security Center: Administrator permissions

In our research, we identified only three obscure, built-in Windows accounts that have enough rights to stop Security Center. Those accounts are DcomLaunch, SecurityHealthService and TrustedInstaller:

Clearly, Microsoft has taken great pains to “lock down” the Security Center service. Best to heed their advice; do not try to stop it.

Is it OK to disable the Security Center service?

Again, because of tight security settings, you will not be able to disable the service from the Services application. And the SC command won’t work either:

However, if you are hell bent on hobbling the service, you can try hacking the registry. Setting the Start value in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc key to 4 should do the trick. You may have to reboot afterwards.

But don’t be surprised if that fails too. For example, Windows 11 restricts access to the registry key to a few built-in accounts. Not even an administrator can update the registry entry. And as you can see, Windows rebuffed our attempt to change the registry value:

Caveat emptor!

Questions? Problems?

If you would like to know more about the Security Center service — or if you have a specific problem with it — please feel free to get in touch. We will do our best to help you!

Q&A: Why can't AlwaysUp run my Batch File?

Why Does Windows SmartScreen Flag Our Software?

Essential Windows Services: Remote Procedure Call (RPC) / RpcSs

Posted in Windows Services | Tagged essential-windows-services, security, security-center-service, windows-services, wscsvc | Leave a comment

Q&A: Why does AlwaysUp Fail to Run my Program?

Posted on June 21, 2022

I set up our application with AlwaysUp but it doesn’t work. When I try to start it, it runs for a few seconds then fails with this error:

AlwaysUpService was unable to start the application properly, failing at least 5 times in 1 minute. AlwaysUpService will now stop.

How do I fix this?

— Mark

Hi Mark.

AlwaysUp can fail to run your application for a variety of reasons. Here are the most common.

Reason #1: Your application cannot run in the account specified on the Logon tab

By default, Windows Services run in the LocalSystem account — a special, predefined account created and managed by Windows itself.

LocalSystem is a fine choice for the builtin Windows Services. That’s because it exists on every computer, doesn’t require a password, and is powerful enough to perform a wide range of administrative tasks.

Consequently, when you setup your application with AlwaysUp, the default is to run in the LocalSystem account. You can see that position on the Logon tab, where the box to override using LocalSystem is not checked:

But for many applications, running in the LocalSystem account will not work. This is particularly true for regular, desktop applications that are designed to operate in the account where they were installed.

For example, let’s review a scenario with Dropbox, the popular cloud storage program.

You’ve installed Dropbox on your PC. You’ve also configured it to synchronize your important folders with the cloud. Everything works well and Dropbox copies your files as expected. Happy day!

Later that week, a co-worker logs on to your PC. They open File Explorer, browse to the Dropbox folder and double-click Dropbox.exe (the executable that runs Dropbox). Dropbox starts, but it comes up “blank”. The files and folders you have configured are nowhere to be seen!

No, Dropbox isn’t broken. On the contrary, it’s working exactly as designed.

You see, when you installed and set up Dropbox, the program saved your configuration in a section of the Windows Registry that only your account can access. And when your co-worker logged on and started Dropbox, they did not see any of your settings because they don’t have access to your private area in the registry where Dropbox stored your settings.

Well, the same is true of the LocalSystem account. It cannot access your Dropbox private settings either. So if you start Dropbox in the LocalSystem account, Dropbox will come up “blank” as well.

In essence, the account where you run your application as a Windows Service can have an enormous impact.

Solution

The remedy is simple. Run your application in a Windows account where you know it works.

In fact, if your application runs fine on your desktop right now, you should use your current account.

To specify your account in AlwaysUp:

Start AlwaysUp
Double-click your application to open the Edit/View Application window
Switch to the Logon tab
Check the Instead of running the application… box at the top
Enter your user name and password:
Don’t know the user name of your current? Run whoami at a command prompt to find out.
Save your settings

Hopefully your application will behave better now that you’re running it in the correct account.

However, if you’re still having problems, try starting your application in the current session which will make it visible on your desktop. Select Start in this session from the Application menu to try:

And now that you can see your application, watch out for warnings and errors that are holding up the action.

Reason #2: Your application has a problem unrelated to AlwaysUp

An application that fails to start with AlwaysUp often fails to start without AlwaysUp as well!

For example, that your application can fail to start because:

It was never installed and configured properly in your account
A recent update (or a Windows patch) broke the software
It’s encountering an error that prevents it from working

Solution

Put AlwaysUp aside and launch your application normally on your desktop.

Does it start? Do you see any errors?

How about in the application’s logs? If your application writes to a log file, be sure to check the file for telltale warnings and errors.

If you find a problem, you must fix it before re-engaging AlwaysUp.

As you can imagine, if your application doesn’t run properly by itself, it won’t magically work as a Windows Service with AlwaysUp either!

Reason #3: Your program starts and completes rapidly

When you run your application normally on your desktop, how long does it take to complete?

If it only runs for a few seconds, AlwaysUp may be misinterpreting the quick exit as a failure to start at all!

We saw this scenario most recently with a customer running a Python script with AlwaysUp. The script would check a folder for new files and close within 1 second if no files were found. And when it exited, AlwaysUp would log an error saying that the script failed to start properly and try to restart it again. The end result was to give up after 5 attempts, just as you reported.

Solution

One quick fix is to ensure that your application takes a bit longer to run. For example, if you’re running a batch file, you can add a TIMEOUT statement right before your script exits.

Similarly, you can delay your C++, C# or VB application by calling Sleep (or an equivalent) to introduce a delay prior to a speedy exit.

However, if you cannot modify your application, you can modify how AlwaysUp works. By creating an empty file named alwaysup-dont-panic-on-quick-exit.txt in your AlwaysUp installation directory (by default, C:\Program Files (x86)\AlwaysUp), you will signal AlwaysUp not to treat a quick exit as a failure.

Hopefully one of these solutions addresses your problem. Please be sure to get in touch again if not!

How Dropbox Auto-Upgrade Works (and How to get AlwaysUp to Play Nice with it)

AlwaysUp 11.5: Improvements for Session 0 Isolation, Server 2019, and more

Investigating OneDrive Failures in Session 0 on Windows Server

Posted in AlwaysUp | Tagged alwaysup, localsystem-account, q&a, support, troubleshooter | Leave a comment

Q&A: Why can’t AlwaysUp Open the Netman Service?

Posted on June 6, 2022

Hi Team,

AlwaysUp can start Thunderbird as a Windows Service and it runs without any problems. But I always get the following warnings:

Unable to ensure that networking components are running: Netman: Unable to open the service: Zugriff verweigert. AlwaysUpService will pause for a few seconds and try again.

Unable to ensure that networking components are running: Netman: Unable to open the service: Zugriff verweigert.

(“Zugriff verweigert” means “Access denied” in English.)

Thunderbird is running as a NON-admin-user on this server.

Is there a way to stop these warnings, or should I just ignore them?

— Oliver

Hi Oliver, thanks for reaching out.

It’s your choice how to handle the warnings. You can ignore the messages because they don’t impact Thunderbird. Or with a few small changes, you can eliminate them altogether. Let’s dig into the details.

Why your Thunderbird service generates the “Access denied” warning

Windows reports the “access denied error” whenever someone tries to perform an operation that they are not allowed to. Think of it as Windows saying “no, you can’t do that”.

In your case, the message is reported because the account you have specified on the AlwaysUp Logon tab doesn’t have enough rights to open the Network Connections (Netman) Windows Service.

That is not a surprise. As you mentioned, you are running Thunderbird as a non-administrative user. And typically, only administrators have access to core services like Netman.

We have investigated this situation with other customers before. Each time, we concluded that the warning could be ignored. That’s because Netman — which handles client network configuration — was already running by the time AlwaysUp started.

However, we also have a couple of solutions for you if ignoring the warnings isn’t good enough.

Solution #1: Delay startup instead of checking the network

Since Thunderbird communicates over the network, it’s good to have AlwaysUp confirm that the network is up before it launches the application. If not, Thunderbird could start too soon and fail.

In those situations, we recommend checking the Ensure that the Windows networking components have started box on the Startup tab:

However, when that box is checked, AlwaysUp tries to open the Netman service. And that is precisely what fails in your case!

So let’s think outside the box. Since AlwaysUp cannot directly wait for the network to start, instead let’s delay AlwaysUp to give the networking components enough time to start.

To do that:

Uncheck the Ensure that the Windows networking components have started box on the Startup tab
On the General tab, choose Automatically, but shortly after the computer boots in the Start the application field:
Save your changes.

With that adjustment in place, Windows will start your Thunderbird Windows Service about 2 minutes after your computer boots. Netman (and other critical services) should definitely be running by then.

Solution #2: Grant your non-admin user rights to the Network Connections Windows Service

If delaying Thunderbird at boot is not acceptable, you can take direct action on the Netman service instead. By allowing your non-admin user to check the Netman service, you can avoid the annoying “access denied” message altogether.

To update Netman’s permissions:

Download our free Service Security Editor utility
Start Service Security Editor
Select Network Connections from the drop-down list and click Open:
In the Service Security Settings window, add the non-admin user and grant them the Read permission (at minimum):
Click OK to save your changes.

And now that your non-admin user has permission to check the state of the Network Connections service, you won’t see the warning anymore.

Happy emailing!

AlwaysUp Version 8.0 Released

How to Survive Automatic Updates when Running 24/7 with AlwaysUp

Q & A: How do I Prevent Multiple Alpha Application Servers from Running?

Posted in AlwaysUp | Tagged access-denied-error, alwaysup, automatic-delayed, mozilla-thunderbird, netman-service, q&a, service-security-editor | Leave a comment

Q&A: Why does AlwaysUp Think my Application Stopped?

Posted on May 23, 2022

Dear AlwaysUp support,

We frequently get the following warning:

AlwaysUpService has detected that the application has stopped.

However, in the logs of our application we can’t see anything pointing to the reason why the application stopped.

Why does AlwaysUp believe our application stopped? What is the criteria for the decision, that an application is considered as stopped?

Our application handles complex tasks. When it’s very busy, it might appear to hang. Could that be a reason for AlwaysUp to say it stopped?

I am pretty sure the process — normally visible in Task Manager — is not stopped, but I’m not 100% sure and I can not prove it. I am wondering if AlwaysUp might close the app by mistake.

— Adrian

Hi Adrian.

Don’t worry! With a little detective work, we should be able to figure out what’s going on.

But first, let’s review how AlwaysUp monitors your application.

How AlwaysUp determines that your application stopped

After AlwaysUp launches your application as a service, it’s primary task is to watch your application and ensure that it’s always running. As such, AlwaysUp performs a battery of tests every few seconds to detect if your application is in trouble.

The most important check involves the state of your application’s process. But what is a process?

When Windows runs your application, it creates a process to track that specific instance of your running application. That process has an identifier (ID) and is visible on the “Details” tab in the Task Manager.

For example, process 9088 was created after we opened Notepad on our desktop:

And when we quit Notepad, process 9088 exited and disappeared from Task manager’s list.

Basically, a process tracks the lifetime of a running application. And everything running on your computer has at least one underlying process.

With that in mind, let’s return to AlwaysUp.

When AlwaysUp launches your application, Windows creates a process and returns it to AlwaysUp. Going forward, every two seconds, AlwaysUp asks Windows if the process is still alive or not. You can think of it like AlwaysUp opening the Task Manager and checking if the process is still on the list.

So when AlwaysUp says that your application has stopped, it’s because the application’s process is no longer active. In effect, the process has fallen off Task Manager’s list.

Investigate with Process Explorer

Have you ever used Microsoft’s free Process Explorer? It’s an amazing tool that can help you figure out what’s running on your machine — and why. Around here, we call it “Task Manager on steroids”. 🙂

Download Process Explorer and extract the zip file to your hard drive. We’ll need it for the next steps.

Dig into the tree of processes under AlwaysUp

Start Process Explorer. It will show all the applications running on your computer.

The leftmost Process column displays the hierarchical relationships between the processes. For example, if “Process A” started “Process B”, you will see “Process B” as a child of “Process A”. “Process B” will be displayed underneath “Process A”.

Now, let’s roll up our sleeves. If you haven’t already done so, please start your application in AlwaysUp. Afterwards, switch back to Process Explorer.

In the Process column, find AlwaysUpService.exe. That is the part of AlwaysUp that runs your application as a Windows Service. It will be a child of services.exe — the Windows Services Control Manager.

Your application should appear under AlwaysUpService.exe. For example, you can see that parent-child relationship when AlwaysUp is running Microsoft OneDrive as a service:

Process Explorer: AlwaysUp running OneDrive

Does your application appear as a child of AlwaysUpService.exe?

Are other processes displayed in the tree as well?

Is this a “launcher” situation, where the application you provided to AlwaysUp starts another program and exits?

Look for anything unusual that may trick AlwaysUp into thinking that your application has stopped even though it’s still running.

Find out when your application started

If you think that your application hasn’t stopped, you should confirm that hypothesis with Process Explorer. Double-click your application’s entry to bring up the Properties window and look for the Started field.

For example, Process Explorer tells us that AlwaysUp last started OneDrive at 12:21:32 PM on March 27 2022:

If everything is working as expected, the start time should be close to the time reported in the AlwaysUp logs. Please be sure to let us know if the times are different because that would indicate a bug in AlwaysUp.

Best of luck with your application!

Running Multiple Windows Services? AlwaysUp 11 is Here to Help!

AlwaysUp Works Well on Windows 10 (but no keyboard or mouse in Session 0)

AlwaysUp not Working? Please Send us these Details so we can Help!

Posted in AlwaysUp | Tagged alwaysup, process-explorer, q&a, task-manager | Leave a comment

Essential Windows Services: Security Accounts Manager / SamSs

Posted on May 9, 2022

In this article…

What is the Security Accounts Manager (SamSs) service?
What happens if I stop SamSs?
Is it OK to disable the Security Accounts Manager service?
What happens if I kill the SamSs process (lsass.exe)?
The SamSs service isn’t starting. Help!
Questions? Problems?

What is the Security Accounts Manager (SamSs) service?

The Security Accounts Manager service administers the database of user and group account information stored on your computer. The service helps to authenticate local and remote users logging on to your PC.

The service’s display name is SamSs and it’s hosted in the LSA process, lsass.exe. By default, the service is set to start automatically when your computer boots:

Security Accounts Manager Windows Service

What happens if I stop SamSs?

The following services depend on SamSs:

Distributed Transaction Coordinator
KtmRm for Distributed Transaction Coordinator
Server

That means that if you stop SamSs, those services will stop as well. And that may cripple your computer.

For example, if the Server service stops, file and printer sharing won’t work. Are those features important to you?

In any case, you may find it next to impossible to stop the SamSs service!

You will notice that the stop button is disabled in the Services application:

And the SC command informs us that the service is not stoppable, cannot be paused and ignores shutdown requests:

Apparently Microsoft really doesn’t want anyone to disturb the Security Accounts Manager service!

Is it OK to disable the Security Accounts Manager service?

The service’s description states:

Disabling this service will prevent other services in the system from being notified when the SAM is ready, which may in turn cause those services to fail to start correctly. This service should not be disabled.

Indeed, Microsoft reiterates their recommendation to keep the service enabled on Windows Server 2016 (with Desktop Experience).

What happens if I kill the SamSs process (lsass.exe)?

The Security Accounts Manager service runs inside the lsass.exe process, which multiple services may share.

For example, here you see three services — SamSs, VaultSvc (Credential Manager), and Keyslo (CNG Key Isolation) — all running in the same instance of lsass.exe (with PID 708):

Because all three services are running in the same process, terminating the process will stop all three services.

That’s probably OK for the CNG Key Isolation service but Credential Manager is a building block for another three services. Be sure to understand the implication of terminating the Credential Manager service before killing the shared lsass process.

The SamSs service isn’t starting. Help!

If Security Accounts Manager failed to start, it is likely that the important Remote Procedure Call (RPC) service didn’t start either.

Open Services and check if someone has disabled the RPC service. If so, you should definitely re-enable it.

After that, try to start the RPC service. If that works, you can start SamSs next.

Questions? Problems?

If you would like to know more about the Security Accounts Manager service, or you have a specific problem, please feel free to get in touch. We will do our best to help you!

Essential Windows Services: Windows Update (wuauserv)

How to Survive Automatic Updates when Running 24/7 with AlwaysUp

Use NET.EXE to start or stop your Windows Service

Essential Tools for Windows Services: The NET Command

Posted in Windows Services | Tagged essential-windows-services, rpc-service, samss-service, server-service, windows-services | 2 Comments

The Core Technologies Blog

Professional Software for Windows Services / 24×7 Operation

Essential Windows Services: Security Center / wscsvc

What is the Security Center (wscsvc) service?

Technical information

What happens if I stop Security Center?

Is it OK to disable the Security Center service?

Questions? Problems?

You may also like...

Q&A: Why can't AlwaysUp run my Batch File?

Why Does Windows SmartScreen Flag Our Software?

Essential Windows Services: Remote Procedure Call (RPC) / RpcSs

Q&A: Why does AlwaysUp Fail to Run my Program?

Reason #1: Your application cannot run in the account specified on the Logon tab

Solution

Reason #2: Your application has a problem unrelated to AlwaysUp

Solution

Reason #3: Your program starts and completes rapidly

Solution

You may also like...

How Dropbox Auto-Upgrade Works (and How to get AlwaysUp to Play Nice with it)

AlwaysUp 11.5: Improvements for Session 0 Isolation, Server 2019, and more

Investigating OneDrive Failures in Session 0 on Windows Server

Q&A: Why can’t AlwaysUp Open the Netman Service?

Why your Thunderbird service generates the “Access denied” warning

Solution #1: Delay startup instead of checking the network

Solution #2: Grant your non-admin user rights to the Network Connections Windows Service

You may also like...

AlwaysUp Version 8.0 Released

How to Survive Automatic Updates when Running 24/7 with AlwaysUp

Q & A: How do I Prevent Multiple Alpha Application Servers from Running?

Q&A: Why does AlwaysUp Think my Application Stopped?

How AlwaysUp determines that your application stopped

Investigate with Process Explorer

Dig into the tree of processes under AlwaysUp

Find out when your application started

You may also like...

Running Multiple Windows Services? AlwaysUp 11 is Here to Help!

AlwaysUp Works Well on Windows 10 (but no keyboard or mouse in Session 0)

AlwaysUp not Working? Please Send us these Details so we can Help!

Essential Windows Services: Security Accounts Manager / SamSs

What is the Security Accounts Manager (SamSs) service?

What happens if I stop SamSs?

Is it OK to disable the Security Accounts Manager service?

What happens if I kill the SamSs process (lsass.exe)?

The SamSs service isn’t starting. Help!

Questions? Problems?

You may also like...

Essential Windows Services: Windows Update (wuauserv)

How to Survive Automatic Updates when Running 24/7 with AlwaysUp

Essential Tools for Windows Services: The NET Command

Products

Topics/Tags

Categories

Archives

Search This Blog