What is the start order of services in Windows server

Question

I have a Windows Service which is working fine in most of the servers. But in one server, I see that it starts before the network services are started. This is causing the services to hang and as a result OS is not booting up. It also gets stuck. What is the usual start order of services? My Windows Service does make TCP connections. Should I add a delayed start? If that's the case, shouldn't all services be having a delayed start following these network services? Any help would be much appreciated.

Solution

Using Delayed Start may be one possible solution.

Another possibility is adding a dependency so that the services start up in the order that you want. For instance, you wouldn't want your service starting before, say, the NSI service, because network connectivity can't happen until the NSI service is running. So add a dependency.

From MSDN:

if an auto-start service depends on a demand-start service, the demand-start service is also started automatically.

(More detail about the start order is in that MSDN article as well.)

Either of those two things might work, though, if I were you, I'd be more interested in figuring out what is different about this one server. It's a good idea to always fully understand what's happening and why before you go modifying system settings and making this one server a "special snowflake" compared to the others.

Edit:

You got me thinking more about the question, "what is the start order of services in Windows," I mean, the exact order, and I don't think the question has ever been thoroughly answered, at least not publically.

I think that's partly due to the fact that it's very complicated. The exact startup order of Windows services is always changing. There are "early start services," "phase 1 services," "phase 2 services," service groups, services that get started because they're dependencies, etc. etc. It'll be slightly different on every version and edition of Windows, and will also vary on different configurations and deployment options. So don't count on it ever being officially documented in anything other than the most generic, relative terms, such as "delay start services start after the auto-start services."

I think it's also partly because it's a bit of a non-deterministic situation. The Service Control Manager (services.exe in user mode) sends the start signal to a service, and the order of that part is pretty deterministic, but the time at which the start signal is sent and the time at which the service actually starts are two different things. Because of the preemptive nature of Windows, we can't always guarantee that service A will start before service B, even if the SCM sent service A the start control first. (Unless we use some sort of synchronization mechanism.)

Anyway, I figured I could at least enable some SCM logging during boot and see the SCM starting all the services, chronologically.

This is Windows 10, RS1/1607. As I mentioned before, your results would vary slightly on basically any other build. Results have been edited for length and content. First, I think it'll be most interesting to show the chronological order in which the services entered the Running state, not necessarily the order in which the SCM attempted to start them.

07/06/17-13:05:39.7425860 [SCM] service PlugPlay, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000005
07/06/17-13:05:39.8150411 [SCM] service Power, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000000
07/06/17-13:05:39.8629388 [SCM] service DcomLaunch, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000080
07/06/17-13:05:39.8699565 [SCM] service RpcEptMapper, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000000
07/06/17-13:05:39.8745944 [SCM] service RpcSs, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x000000c0
07/06/17-13:05:39.9107503 [SCM] service BrokerInfrastructure, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00001080
07/06/17-13:05:39.9276072 [SCM] service LSM, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000000
07/06/17-13:05:40.0868049 [SCM] service SystemEventsBroker, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x000012c1
07/06/17-13:05:40.4599977 [SCM] service nsi, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000001
07/06/17-13:05:40.4641823 [SCM] service lmhosts, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000001
07/06/17-13:05:40.4705790 [SCM] service TermService, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000005
07/06/17-13:05:40.4708935 [SCM] service CoreMessagingRegistrar, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000000
07/06/17-13:05:40.4943177 [SCM] service gpsvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000141
07/06/17-13:05:40.4975091 [SCM] service gpsvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000541
07/06/17-13:05:40.5067210 [SCM] service TimeBrokerSvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000241
07/06/17-13:05:40.5877317 [SCM] service UmRdpService, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000085
07/06/17-13:05:40.6327091 [SCM] service Dnscache, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000059
07/06/17-13:05:40.6501216 [SCM] service CertPropSvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000085
07/06/17-13:05:40.6716164 [SCM] service Dhcp, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000005
07/06/17-13:05:40.6785583 [SCM] service Schedule, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x000012c5
07/06/17-13:05:40.7442193 [SCM] service LanmanWorkstation, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000043
07/06/17-13:05:40.7560620 [SCM] service EventLog, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000205
07/06/17-13:05:40.8915301 [SCM] service SessionEnv, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000281
07/06/17-13:05:40.9149615 [SCM] service ProfSvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000005
07/06/17-13:05:40.9173657 [SCM] service NlaSvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x000000c1
07/06/17-13:05:40.9429894 [SCM] service netprofm, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x000000c1
07/06/17-13:05:40.9494092 [SCM] service UserManager, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000001
07/06/17-13:05:41.0502482 [SCM] service NcbService, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000081
07/06/17-13:05:41.2351873 [SCM] service vmickvpexchange, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000003
07/06/17-13:05:41.2897569 [SCM] service vmictimesync, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000003
07/06/17-13:05:41.3259511 [SCM] service vmicshutdown, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000003
07/06/17-13:05:41.3284648 [SCM] service vmicvss, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000103
07/06/17-13:05:41.3444338 [SCM] service Themes, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000001
07/06/17-13:05:41.3548424 [SCM] service vmicrdv, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000003
07/06/17-13:05:41.3823139 [SCM] service WPDBusEnum, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x000004c1
07/06/17-13:05:41.3843401 [SCM] service WinHttpAutoProxySvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000041
07/06/17-13:05:41.3856439 [SCM] service vmicheartbeat, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000003
07/06/17-13:05:41.3874138 [SCM] service EventSystem, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000001
07/06/17-13:05:41.5580789 [SCM] service SENS, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000041
07/06/17-13:05:41.6772846 [SCM] service FontCache, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000005
07/06/17-13:05:41.9209576 [SCM] service AudioEndpointBuilder, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x000000c1
07/06/17-13:05:42.0189267 [SCM] service VSS, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000005
07/06/17-13:05:42.0210403 [SCM] service Audiosrv, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x000000c1
07/06/17-13:05:42.0484759 [SCM] service SamSs, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000000
07/06/17-13:05:42.2429764 [SCM] service Wcmsvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x000012c5
07/06/17-13:05:42.2906325 [SCM] service ShellHWDetection, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x000000c1
07/06/17-13:05:42.5323497 [SCM] service Spooler, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x000004c1
07/06/17-13:05:42.5431893 [SCM] service ScDeviceEnum, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000481
07/06/17-13:05:42.5485449 [SCM] service wudfsvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000000
07/06/17-13:05:42.5989161 [SCM] service NetSetupSvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000001
07/06/17-13:05:42.6021970 [SCM] service WbioSrvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000441
07/06/17-13:05:42.6391087 [SCM] service SCardSvr, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000481
07/06/17-13:05:42.7007534 [SCM] service NgcCtnrSvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000001
07/06/17-13:05:42.7017472 [SCM] service BFE, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000041
07/06/17-13:05:42.7098576 [SCM] service Winmgmt, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000007
07/06/17-13:05:42.7222523 [SCM] service Netlogon, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000003
07/06/17-13:05:42.8153049 [SCM] service iphlpsvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x000000c9
07/06/17-13:05:42.8854162 [SCM] service CryptSvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000085
07/06/17-13:05:42.8857247 [SCM] service DPS, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000005
07/06/17-13:05:43.0717978 [SCM] service LanmanServer, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000001
07/06/17-13:05:44.1651270 [SCM] service PcaSvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000085
07/06/17-13:05:44.3247890 [SCM] service TrkWks, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000005
07/06/17-13:05:44.3303880 [SCM] service DiagTrack, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x000013c5
07/06/17-13:05:44.3364873 [SCM] service MpsSvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000001
07/06/17-13:05:44.3497466 [SCM] service SysMain, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x000000c5
07/06/17-13:05:44.3573408 [SCM] service WpnService, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000401
07/06/17-13:05:44.3581205 [SCM] service WdiServiceHost, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000005
07/06/17-13:05:44.7769374 [SCM] service sppsvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000005
07/06/17-13:05:45.1100224 [SCM] service wisvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000005
07/06/17-13:05:45.2168257 [SCM] service fhsvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x000004c5
07/06/17-13:05:45.2489211 [SCM] service WinDefend, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x000000c5
07/06/17-13:05:45.3731715 [SCM] service wuauserv, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x000000c5
07/06/17-13:05:45.3899756 [SCM] service WinHttpAutoProxySvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000041
07/06/17-13:05:45.3958062 [SCM] service StateRepository, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x0000000d
07/06/17-13:05:45.6152215 [SCM] service tiledatamodelsvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000181
07/06/17-13:05:47.3504859 [SCM] service SCardSvr, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000481
07/06/17-13:05:47.5248612 [SCM] service WdNisSvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000001
07/06/17-13:05:47.9543134 [SCM] service SCardSvr, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000481
07/06/17-13:05:47.9543975 [SCM] service SCardSvr, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000481
07/06/17-13:05:48.5741736 [SCM] service CDPUserSvc_33f2e, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x000000c1
07/06/17-13:05:50.7171925 [SCM] service W32Time, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x0000007d
07/06/17-13:05:51.0991216 [SCM] service wlidsvc, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000081
07/06/17-13:05:51.2245142 [SCM] service KeyIso, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000001
07/06/17-13:05:51.4173887 [SCM] service WSearch, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x000010c5
07/06/17-13:05:52.7271615 [SCM] service Appinfo, state 0x00000004(SERVICE_RUNNING), exit 0, sexit 0, controls 0x00000081

And next, we have a chronological listing of Windows services that the SCM sent start controls to. Notice this list is shorter. And it may not always be in the same order.

07/06/17-13:05:40.4600357 [SCM] Successfully sent start control to service gpsvc, user S-1-5-18
07/06/17-13:05:40.4601289 [SCM] Successfully sent start control to service lmhosts, user S-1-5-18
07/06/17-13:05:40.4601542 [SCM] Successfully sent start control to service CoreMessagingRegistrar, user S-1-5-90-0-1
07/06/17-13:05:40.4602090 [SCM] Successfully sent start control to service TermService, user S-1-5-18
07/06/17-13:05:40.4602341 [SCM] Successfully sent start control to service NcbService, user S-1-5-18
07/06/17-13:05:40.4602536 [SCM] Successfully sent start control to service W32Time, user S-1-5-18
07/06/17-13:05:40.4660675 [SCM] Successfully sent start control to service TimeBrokerSvc, user S-1-5-18
07/06/17-13:05:40.5068238 [SCM] Successfully sent start control to service Schedule, user S-1-5-18
07/06/17-13:05:40.5435413 [SCM] Successfully sent start control to service RdpVideoMiniport, user S-1-5-20
07/06/17-13:05:40.5877716 [SCM] Successfully sent start control to service UmRdpService, user S-1-5-20
07/06/17-13:05:40.6336400 [SCM] Successfully sent start control to service CertPropSvc, user S-1-5-20
07/06/17-13:05:40.8919486 [SCM] Successfully sent start control to service SessionEnv, user S-1-5-20
07/06/17-13:05:40.9437595 [SCM] Successfully sent start control to service netprofm, user S-1-5-18
07/06/17-13:05:40.9437849 [SCM] Successfully sent start control to service UserManager, user S-1-5-18
07/06/17-13:05:41.2444548 [SCM] Successfully sent start control to service vmickvpexchange, user S-1-5-18
07/06/17-13:05:41.2898074 [SCM] Successfully sent start control to service vmicvss, user S-1-5-18
07/06/17-13:05:41.2898367 [SCM] Successfully sent start control to service vmicshutdown, user S-1-5-18
07/06/17-13:05:41.2902957 [SCM] Successfully sent start control to service vmictimesync, user S-1-5-18
07/06/17-13:05:41.3260049 [SCM] Successfully sent start control to service WPDBusEnum, user S-1-5-18
07/06/17-13:05:41.3444823 [SCM] Successfully sent start control to service vmicheartbeat, user S-1-5-18
07/06/17-13:05:41.3548887 [SCM] Successfully sent start control to service WinHttpAutoProxySvc, user S-1-5-20
07/06/17-13:05:41.3549103 [SCM] Successfully sent start control to service vmicrdv, user S-1-5-18
07/06/17-13:05:41.9211318 [SCM] Successfully sent start control to service VSS, user S-1-5-18
07/06/17-13:05:42.5324545 [SCM] Successfully sent start control to service ScDeviceEnum, user S-1-5-18
07/06/17-13:05:42.5989696 [SCM] Successfully sent start control to service NetSetupSvc, user S-1-5-18
07/06/17-13:05:42.7008186 [SCM] Successfully sent start control to service NgcCtnrSvc, user S-1-5-18
07/06/17-13:05:44.1651981 [SCM] Successfully sent start control to service WdiServiceHost, user S-1-5-19
07/06/17-13:05:44.3231928 [SCM] Successfully sent start control to service NcaSvc, user S-1-5-18
07/06/17-13:05:44.7769902 [SCM] Successfully sent start control to service sppsvc, user S-1-5-20
07/06/17-13:05:45.1100675 [SCM] Successfully sent start control to service wisvc, user S-1-5-18
07/06/17-13:05:45.2169191 [SCM] Successfully sent start control to service wuauserv, user S-1-5-18
07/06/17-13:05:45.2169410 [SCM] Successfully sent start control to service fhsvc, user S-1-5-18
07/06/17-13:05:45.6471780 [SCM] Successfully sent start control to service NcaSvc, user S-1-5-18
07/06/17-13:05:47.3489415 [SCM] Successfully sent start control to service WdNisSvc, user S-1-5-18
07/06/17-13:05:49.4258072 [SCM] Successfully sent start control to service CDPSvc, user S-1-5-18
07/06/17-13:05:50.9283667 [SCM] Successfully sent start control to service WSearch, user S-1-5-18
07/06/17-13:05:51.0034313 [SCM] Successfully sent start control to service wlidsvc, user S-1-5-18
07/06/17-13:05:51.1906412 [SCM] Successfully sent start control to service KeyIso, user S-1-5-18
07/06/17-13:05:52.5810658 [SCM] Successfully sent start control to service Appinfo, user S-1-5-18

Comments

[Chopper3]

Delay it then...

[AnOldSoul]

@Chopper3 if that's the case, there can never be services having automatic startup right?

[Vadzim]

Similar: serverfault.com/questions/84181/…

[Krapow]

See accepted answer here for informations: social.technet.microsoft.com/Forums/windowsserver/en-US/…

[AnOldSoul]

Hi Ryan, aren't these network services part of the system services? Shouldn't they start before the installed services start?

[Paula]

Windows doesn't make much of a distinction between system services and installed services. If an installed service isn't marked dependent on a system services, it's free to start earlier. The correct way to ensure your service starts after a service it's dependent on is ... to mark it as dependent on that service.

[yagmoth555]

A note we could add to the answer is the registry list certain service that are needed by the kernel vs other that are independant, thus it impact the load order. A good link ; m.windowsitpro.com/windows-server/…

[Frank Hintsch]

How did you produce these SCM logs?

[Nick Westgate]

@FrankHintsch There's some info about SCM diagnostic logging at the following link, but I haven't found any info with the strings in Ryan's answer. geoffchappell.com/studies/windows/win32/services/scm/events/‌​…