Better Windows ServicesQuestions, and the limits
A tool that quietly fails to cover something is worse than one that says what it cannot do. The limits are on this page too, in two groups: what it refuses by design, and what Windows does that this tool reports as it is.
How is this different from sc.exe, Get-Service or services.msc?
sc query and Get-Service tell you what is running. services.msc lets you change it, one row at a time, with no way to ask a question and no record afterwards. This tool asks the question (start:auto !status:running), shows you the plan before it acts, and keeps a snapshot you can diff a week later. Where it disagrees with sc.exe about a service, that is a bug - part of the test suite runs both and compares them entry by entry. The longer comparison is here.
Does it need the internet?
Never. No telemetry, no update check, no crash reporting, no account, no client of anything. The one time it can touch a network at all is when you pass --follow-network: then it may look at a launch path on another machine's share, and let Windows fetch a certificate this machine does not already hold - off by default, and the help says why. The GitHub and Donate buttons in the window and the page in its Help menu each hand one fixed address to your browser when you press them, and your browser is what connects.
Does it need administrator rights?
To look, no. To change, yes. Without them the manager shows fewer entries and refuses more, and both halves say so at the top rather than pretending the list is the whole machine. The window offers Restart as admin. It never elevates itself.
Is it free? Can I use it at work?
Yes to both. GPL-3.0, no strings attached. A snapshot you take is your file.
Will it break my server?
Not by itself. Nothing is changed without a plan you have seen, drivers are refused, and a plan that would take down something the machine needs says so. What it cannot protect you from is carrying out a plan you did not read. The list of services the machine needs is a starter list of seven - the two halves of RPC and the DCOM launcher, the account manager, key isolation, the session manager and plug and play - and Remote Desktop is not on it, so over a remote session, read the plan.
Is this a Microsoft product?
No. Better Windows Services is an independent open source project and is not affiliated with, endorsed by or sponsored by Microsoft. Windows is a trademark of the Microsoft group of companies.
Is the program in my language?
No - the program speaks English, which is why this site is translated. The window reads a language file, languages\gui.<code>.json, placed beside the executable and picks it by the language of Windows, with no switch, so a translation is a contribution that can be added without rebuilding the program. The names of the services in the list are whatever your Windows says they are - in the language your Windows is set up in.
Why is the window dark when my Windows is light?
It is dark and it stays dark whatever Windows is set to, including a high contrast theme. That is checked rather than assumed - it keeps its own colours and stays readable, and it does not follow that setting.
By design
- Local machine only. Remote management is not in this version. To compare two machines, take a snapshot on each and diff the two files.
- Windows only, 64-bit only, Windows 10 1809 or Windows Server 2019 and later.
- Operations on drivers are refused rather than attempted, because stopping a kernel driver is often not reversible without a restart.
- The tool does not raise its own privileges. When the manager refuses, it says so and ends with exit code
3. The window offers to restart itself as administrator, and does nothing else about it. - Certificate revocation is not checked. It would need to reach the network, and this tool never does. So Trusted means the chain was valid on this machine, not that nobody revoked the certificate since.
- The window unpacks part of the Windows user interface framework before it starts. As one file it carries a few native libraries that Windows can only load from disk. Without administrator rights it writes them, on the first start of each version, to a
.netfolder under the account's temporary folder and loads them from there. With administrator rights it usesProgramData\BetterWindowsServiceson the Windows drive instead - a folder it creates so that only administrators can change it, and checks at every start. If that folder cannot be created, or others can change it, the window does not start and says which folder and what to do. Moving there means an elevated window starts itself a second time, which takes a fraction of a second, and each version leaves its libraries there (about 8 MB) until somebody deletes the folder. The command line carries no such libraries and unpacks nothing. - An elevated session names the .NET settings it inherits rather than refusing them. A profiler, a trace or dump switch, or a diagnostic port set in the environment cannot be switched off from inside a .NET program, so with administrator rights both halves list any they find. Startup hooks are switched off outright.
Things Windows does that this tool reports as they are
- A service hosted inside
svchosthas a launch path naming the host, so the file is there and who signed it both say less than they do for a service with a process of its own. - A file with both its own signature and a Windows catalogue entry can name two different signers. The publisher shown is the one inside the file - the one that stays the same when the file is looked at on another machine - and it can differ from what PowerShell reports.
- Without administrator rights the manager lists fewer entries and refuses more of what it lists. Both halves say so at the top, and a snapshot records it, because comparing an elevated snapshot against one taken without rights would otherwise report entries as removed that nobody removed.
Found a problem, or a service this tool reports differently from sc.exe? The issue tracker is open, and a diff between the two is the most useful thing you can paste into it.