Better Windows Services
Questions

Questions, and the limits

A tool that quietly fails to cover something is worse than one that says what it cannot do. The limits are on this page too, in three groups: not built yet, by design, and what Windows does that this tool reports as it is.

How is this different from sc.exe, Get-Service or services.msc?

sc query and Get-Service tell you what is running. services.msc lets you change it, one row at a time, with no way to ask a question and no record afterwards. This tool asks the question (start:auto !status:running), shows you the plan before it acts, and keeps a snapshot you can diff a week later. Where it disagrees with sc.exe about a service, that is a bug - part of the test suite runs both and compares them entry by entry. The longer comparison is here.

Does it need the internet?

Never. No telemetry, no update check, no crash reporting, no account, no client of anything. The one time it can touch a network at all is when a service's launch path points at another machine's share and you pass --follow-network to let it look there - off by default, and the help says why.

Does it need administrator rights?

To look, no. To change, yes. Without them the manager shows fewer entries and refuses more, and both halves say so at the top rather than pretending the list is the whole machine. The window offers Restart as admin. It never elevates itself.

Is it free? Can I use it at work?

Yes to both. GPL-3.0, no strings attached. A snapshot you take is your file.

Will it break my server?

Not by itself. Nothing is changed without a plan you have seen, drivers are refused, and a plan that would take down something the machine needs says so. What it cannot protect you from is carrying out a plan you did not read. The list of services the machine needs is a starter list of seven - the two halves of RPC, the account manager, key isolation, the session manager and plug and play - and Remote Desktop is not on it, so over a remote session, read the plan.

Is this a Microsoft product?

No. Better Windows Services is an independent open source project and is not affiliated with, endorsed by or sponsored by Microsoft. Windows is a trademark of the Microsoft group of companies.

Why is the window dark when my Windows is light?

It is dark and it stays dark whatever Windows is set to, including a high contrast theme. That is checked rather than assumed - it keeps its own colours and stays readable, and it does not follow that setting.

What about the second half - who changed it, and putting it back?

Not yet, and it is the next thing. A change journal read from the event log, a stock Windows baseline per build, and restoring configuration from a snapshot with a dry run and a checkbox per item are the plan. Until then a snapshot at deployment and a diff against the machine answer what changed, which is most of the question.

Honest limits

Not built yet

Most of this is the second half of the audit story.

  • Snapshots are on the command line only. The window shows, searches and changes, and it does not take or compare snapshots. Use bws snapshot beside it.
  • No stock Windows baseline. The opening screen has a place for how many of these are not from a clean install and says it is not counted yet rather than showing a number it cannot stand behind.
  • No change journal. Who changed a start type, and when, is not read from the event log yet.
  • No restore from a snapshot. A diff tells you what drifted, and putting it back is by hand or by script from the commands the diff shows you.
  • No creating, deleting or repointing a service. The launch path is read and reported, and it is not edited.
  • No recovery actions. Not read, not shown, not searchable.

By design

  • Local machine only. Remote management is not in this version. To compare two machines, take a snapshot on each and diff the two files.
  • Windows only, 64-bit only, Windows 10 1809 or Windows Server 2019 and later.
  • Operations on drivers are refused rather than attempted, because stopping a kernel driver is often not reversible without a restart.
  • The tool does not raise its own privileges. When the manager refuses, it says so and ends with exit code 3. The window offers to restart itself as administrator, and does nothing else about it.
  • Certificate revocation is not checked. It would need to reach the network, and this tool never does.

Things Windows does that this tool reports as they are

  • A service hosted inside svchost has a launch path naming the host, so the file is there and who signed it both say less than they do for a service with a process of its own.
  • A file with both its own signature and a Windows catalogue entry can name two different signers. The publisher shown is the one inside the file - the one that stays the same when the file is looked at on another machine - and it can differ from what PowerShell reports.
  • Without administrator rights the manager lists fewer entries and refuses more of what it lists. Both halves say so at the top, and a snapshot records it, because comparing an elevated snapshot against one taken without rights would otherwise report entries as removed that nobody removed.

Found a problem, or a service this tool reports differently from sc.exe? The issue tracker is open, and a diff between the two is the most useful thing you can paste into it.