Image for post
Image for post

Force Microsoft Windows Service Settings

There are services within Microsoft Windows operating system that one cannot easily configure as in StartupType=Disabled. This post will show how to ensure a service is disabled regardless of errors encountered when using traditional means (e.g. gui (MMC), commandline (cmd), PowerShell) and without delving into ACLs.

This issue was identified while implementing Microsoft Desired State Configuration (DSC) on Windows Server 2019.

All of the following was launched from an elevated command prompt as Administrator.

Microsoft Management Console (MMC)

When working with Microsoft Windows services, most use services.msc. To launch, simply type services.msc into the Run dialog box and click OK. Some services cannot be modified via this MMC. For example, ClipSVC has the Startup Type drop-down grayed out thus preventing any configuration changes.

grayed out service properties.
grayed out service properties.

Command Line (cmd.exe)

The sc command has been commonly used to modify services since the early days. Unfortunately it too returns an error when trying to modify ClipSVC.

sc config command results in access is denied.
sc config command results in access is denied.

PowerShell

The Set-Service PowerShell cmdlet errors out as well as the following shows.

powershell set-service error
powershell set-service error

Registry

The best method for disabling a service, or specifying any service property for that matter, is to use the registry. Service configurations are stored under the following registry key:

Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services

In regedit it should look like the following. Scroll down the list to find the service you’re interested in modifying. Then set theStart REG_DWORD to 4 if you want to disable the service.

Image for post
Image for post

If PowerShell is preferred, the following command will disable a service by setting Start=4 in the registry configuration. Be sure to launch from an elevated command prompt.

Set-ItemProperty -Path HKLM:\SYSTEM\ControlSet001\Services\ClipSVC -Name Start -Value 4

The downside to modifying registry entries is it most often requires a reboot to take effect. There are exceptions though plan to reboot the system after making configuration changes such as this.

Desired State Configuration (DSC)

As mentioned above, this issue was found when implementing DSC on Windows Server 2019. Configuration would result in a failed state since the service configurations failed. Each failed service then got a registry setting (example below) to go along with it’s service configuration to workaround the permissions issue. After a reboot, DSC successfully completes.

clipsvc dsc registry config
clipsvc dsc registry config

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store