Better Windows ServicesA service stuck on Stopping...
The snap-in shows Stopping and never moves. The usual answer is Task Manager, a guess at which svchost.exe it lives in, and End task - which ends every other service in that process too, without telling you which ones they were.
Why it happens
- The service is not answering the stop request. Windows asks it politely and waits. A service that has hung, or is waiting on something that will not come back, never answers.
- Something that depends on it is still running. The manager refuses the stop rather than breaking the other one, and the snap-in shows that as a wait.
- It shares its process with others. Most Windows services live inside a shared
svchost.exe. Ending that process ends all of them, which is exactly what Task Manager does without naming them.
Look before you end anything
Ask what ending it would take with it. Nothing happens until you drop --dry-run.
$ bws kill Spooler --dry-runThe preview names the process by number, names every other service living in it, and shows two steps rather than one: ask the service to stop, and only if that does not work, end the process. A service that stops on its own is never ended.
--forceskips the polite step and ends the process straight away. It changes the plan rather than the running of it, so the preview shows one step instead of two and the difference is visible before anything happens.--restartbrings everything back once the process is gone - the entry you asked about and everything that shared its process. Without it, the machine is left with those services stopped, and the report says how to start them again.
- The refusal comes before the button. A driver, a process the system protects, a service the manager will not accept a stop for - refused when the plan is built, with the reason, rather than after a sixty second wait.
- A warning when it matters. If the entry is one the machine does not work without, the plan says so - stopping it takes the machine down, not just the service.
Ending a process is the one thing this tool does that nobody can refuse on the machine's behalf. That is why it is a verb of its own, why the preview names every service it takes with it, and why the polite step comes first unless you say otherwise.
The safer order
- See what it is.
bws show Spooler- the process, what depends on it, what it depends on, and whether it is accepting stop requests at all. - Try the ordinary stop, as a plan.
bws stop Spooler --dry-run --dependents. If the answer is a refusal, it says which of the three reasons it is. - If it will not stop, look at what ending it costs.
bws kill Spooler --dry-run, and read the list of services sharing that process. - Then do it, with a way back.
bws kill Spooler --restart. The report ends with what did not work and the commands that put things back.
All four work the same way in the window: right-click a row, choose What force stopping would do, read the plan, and the button under it is named after what it will do.
Why not just use Task Manager
Because it answers a different question. Task Manager knows about processes and this problem is about services, and the two do not line up one to one.
A shared svchost.exe can hold a dozen services. Task Manager will end it without saying which twelve, none of them come back on their own, and nothing afterwards tells you what stopped. An EDR that flags a process ending svchost.exe is doing its job, and it cannot tell your click from anything else's.