1. Windows Processes and Services
Lecture 4
Windows Processes and Services

2. Objectives Services Processes Regedit Event Viewer Task Scheduler
Task Manager
Services.msc
Processes
Process Monitor
Regedit
Event Viewer
Task Scheduler

3. Services Computer programs operating in the background
Basically applications, plus extra methods of control for Service Manager
Start(), Stop(), Pause(), Continue()
Interface with the Service Control Manager
Can run on startup, manually, or on an event; even when user isn’t logged on
Account contexts: System, Network Service, Local Service
Associated with Host Process for Windows Services, or svchost.exe
On start: application domain created; service class initialized; Start() called.
On stop: Stop() called; application domain unloaded from memory.

4. Services Managing Services in Task Manager
Task Manager’s “Services” tab shows all services, running or not.
Name
PID: associated process identifier
Description of service
Status: running or stopped
Group: service group
Right-click context menu used to control each service

5. Services
Or, click the Services button to open the Component Services tool.
Manage, configure, initialize, remove, pause services
Specify start type: automatic, automatic and delayed, manually, or disabled
The system can start the service on need (“Manual”), or have it run automatically (“Automatic”)
Many services are pre-configured, installed with Windows, and activated by default.
Others are available, but not started by default.
Other ways to get to the Component Services tool are:
Administrative Tools -> Computer Management
Right click the “Computer” desktop icon -> Manage -> Services & Applications -> Services
Type “services.msc” into Run or Start.

6. Services

7. Processes Multitasking in Windows
Windows can “multitask”, but can actually perform only one task at a time.
So, Windows switches rapidly between all running programs. This creates the illusion that programs are running in parallel.
However, with crashes, the processor gets locked up in one process and stays there. This is why all programs stop working.
What is a Process?
Executable program that’s in the process of being executed.
It’s loaded into RAM when started.
Windows then adds the new process to its internal process list.
Allocates CPU time, memory, other resources
However: CPU time isn’t requested; it’s shared equally.
Processes can return the CPU time to Windows before their time allotment is up.
This is the reason why your CPU usage isn’t constantly at 100%.
Allows the process to request unlimited resources from Windows, as long as they are available
Upon close: resources are returned to Windows for allocation to other processes.

8. Processes Managing Process Tasks in Task Manager
Task Manager’s “Processes” tab (Figure 15.21) lists all currently running processes, plus attributes:
Image Name: process name
User Name: user account running the process
CPU: % CPU being utilized by process
Memory, or Private Working Set: amount of memory in use
Description
To organize the list of processes, click the column headings.
Clicking once sorts in descending order.
Clicking twice reverses the order and sorts by ascending.
Column headings can be customized by going to View -> “Select Columns”.
To manage processes, right-click and choose a context menu option. For example:
End the process or process tree;
Debug the process;
Create a dump file;
Set priority or affinity (assign the process to a specific processor.)

9. Processes

10. Processes Stopping Processes
You might need to stop a process that isn’t executing properly.
Select the process to stop in the “Processes” tab, then click the “End Process” button and confirm.
Or, right-click and choose “End Process Tree” to end the process, plus those it has created.
Setting Process Priority
To manage priority, right-click the applicable process and select “Set Priority.”
Choose from Realtime (use caution!), Above Normal, Normal, Below Normal, and Low.
As you might expect, Normal’s the default option.

11. Processes Process Monitor
Process Monitor is an alternative, more advanced monitoring tool for Windows.
It combines two older Sysinternals utilities, Filemon and Regmon.
It shows real-time file system, Registry, and process/thread activity.
Features include rich and non-destructive filtering, comprehensive event properties, more reliable process information, full thread stacks, logging to files, and more.

12. Processes
Process Monitor includes powerful features, benefits, monitoring and filtering capabilities, including:
More data captured for operation input and output parameters;
Non-destructive filters allow you to set filters without losing data;
Capture of thread stacks for each operation make it possible in many cases to identify the root cause of an operation;
Reliable capture of process details, including image path, command line, user and session ID;
Configurable and moveable columns for any event property;
Filters can be set for any data field, including fields not configured as columns;
Advanced logging architecture scales to tens of millions of captured events and gigabytes of log data;
Process tree tool shows relationship of all processes referenced in a trace;
Native log format preserves all data for loading in a different Process Monitor instance;
Process tooltip for easy viewing of process image information;
Detail tooltip allows convenient access to formatted data that doesn't fit in the column.

13. Processes

14. Task Scheduler Overview
Windows’ Task Scheduler utility lets you schedule actions to occur at specified intervals.
To get there, type “Task Scheduler” into Start.
Creating a Basic Scheduled Task
To create a basic task, select “Create Basic Task” in the Actions pane on the right-side of the window.
With a basic task, you can set any program to run automatically at a specific time, date and interval.
Actions can be performed when the following triggers are activated:
Daily, or once every number of days;
Weekly, on certain days of the week, or every number of weeks;
Monthly, on selected days of the month, or only on selected months;
One time only;
When the computer starts.

15. Task Scheduler Task Scheduler Triggers (continued) When you log on
When a specific event is logged
Start a program.
Send an .
Display a message.

16. Task Scheduler Managing Scheduled Task Properties
Scheduled tasks can be managed through their “Properties” dialog boxes.
Right-click desired task, and choose “Properties”.
Six tabs for configuration:
General:
Description
Username, group used to run the task
Whether to run when user is logged off
Whether task is hidden
Triggers: the task’s configured schedule -- edit, new, delete
Actions: the task’s configured actions -- edit, new, delete
(continued…)

17. Task Scheduler Conditions: Shows task’s associated conditions
Idle section: useful if computer must be idle when task is run
How long the computer should be idle before start;
Stop task if the computer is no longer idle.
Power section: useful for devices w/ batteries
Don’t start if the device is on battery;
Stop task if battery mode begins;
Wake the computer to run the task.
Network section: start whenever specific network connection is available
Settings:
Shows settings affecting the task:
Whether the task can be run on demand;
Whether the task should be restarted if it is missed;
How often the task should be restarted if it fails.

18. Task Scheduler Settings (continued):
When to stop the task if it runs a long time;
Whether you can force the task to stop;
When the task should be deleted;
What actions should occur if the task is already running.
History:
Shows task’s historical information:
Start time;
Stop time;
Completed successfully or no.
Useful for troubleshooting if the task doesn’t start at the appropriate time.

19. Task Scheduler

20. Event Viewer Event Viewer
Event Viewer enables you to view event logs created by the OS.
It is useful when troubleshooting problems that occur on your computer.

21. Event Viewer Error Logging
Whenever an error occurs, events are usually placed in 1+ event logs, including:
Application: logs application-related events, e.g. when an application, driver, or service fails;
Security: logs security events, e.g. successful or failed login attempts;
Setup: used only by domain controllers
System: concerned w/ OS and related services
Forwarded Events: collects events forwarded from other computers.
To open:
Start -> Control Panel -> System and Security -> Administrative Tools -> View Event Logs
Or type “Event Viewer” into Start.
To configure log settings:
Right-click the desired log, then select “Properties.”
The “Log Properties” dialog box will appear.

22. Event Viewer

23. Event Viewer
The “Log Properties” dialog box shows the following information:
The full name of the log
Where the log is stored
The size of the log
When the log was created, modified, and accessed
Whether logging is enabled for the ldog
The maximum log size in KB
The action that occurs when the log reaches the max size
The Custom Views section can be used to create a view that contains only the information you want to see.
Examples: only events in a particular log or only Critical events.
“Administrative Events” created for you by default.

24. Event Viewer
Administrative Events view: contains all logs’ Critical, Error, and Warning events, enabling you to easily view only the most important events.
Another section in the left pane contains logs that relate to Applications and Services.
The Microsoft folder within the Application and Services Log contains many other logs related to specific Microsoft components and applications.
Subscription folder: enables you to receive event logs from other computers
One place to view events from multiple locations.
Windows Event Collector Service must be started.
Center pane: displays events, information relating to them.
Also contains summary of administrative events, incl. a count of Critical, Error, Warning, Information, Audit Success, and Audit Failure events for the last hour, day, week, in total
Each event is assigned an event level of Critical, Error, Warning, Information, or Verbose.
Right pane: perform actions on items selected in left and center panes.
Save, open, filter, clear, and sort logs;
Clear create or import views;
Attach a task to an event.

25. Regedit
In some cases, services may need to be enabled, disabled manually.
Examples: if the Services console broken; or if services need to be managed remotely.
To enable services on the computer through the registry:
Start the Registry Editor; type regedit in Start.
Browse through the left tree to where Services are found: HKEY_LOCAL_MACHINE\System \CurrentControlSet\Services.
...

26. Regedit ...Find the short-name of the desired service.
For example, “RpcSS” represents Remote Procedure Call (RPC)):
HKEY_LOCAL_MACHINE \System \CurrentControlSet \Services \RpcSS.

27. Regedit Double-click the “Start” value in the list to the right.
Change the “Value data” to the desired state:
0 = Boot;
1 = System;
2 = Automatic;
3 = Manual;
4 = Disabled.
Press “OK” and exit the Registry Editor.
If setting a service to Disabled or Manual, then execute “net stop [short name]” to stop the service.
If setting a service to Automatic, then execute this command “net start [short name]” to start the service.