What does "Manual (Trigger Start)" mean for a Windows Service?

Windows Services with a Manual (Trigger Start) Startup Type

There's a selection of different startup types that can be assigned to a Windows Service, at least as seen in the Services MMC snap-in, such as:

  • Disabled
  • Manual
  • Automatic
  • Automatic (Delayed Start)
  • Manual (Trigger Start)
  • Automatic (Trigger Start)

The bit in brackets (Trigger Start / Delayed Start) is actually a "sub-startup-type" (that's my name, not Microsofts!) although obviously "Delayed Start" wouldn't have much/any meaning for a service set to the Manual startup type. The "base" startup type (Disabled / Manual / Automatic) is set when you call the Win32 API CreateService, "Delayed Start" and "Trigger Start" are set by calling ChangeServiceConfig2 for an already extant service, passing in an SERVICE_DELAYED_AUTO_START_INFO structure or a SERVICE_TRIGGER_INFO structure respectively.

Why is this even vaguely interesting?

It's a bit of preamble to get to talking about triggered services. These can be on both Manual and Automatic services, so you can have an automatic service that starts when Windows loads, does its stuff then stops until it's triggered as well as a service that's only started when it's triggered. Picking on the Windows Time (w32time) service on Windows Server 2012, you can run sc qtriggerinfo w32time to see what triggers are present:

[SC] QueryServiceConfig2 SUCCESS


          DOMAIN JOINED STATUS         : 1ce20aba-9851-4421-9430-1ddeb766e809 [DOMAIN JOINED]
          DOMAIN JOINED STATUS         : ddaf516e-58c2-4866-9574-c3b615d42ea1 [NOT DOMAIN JOINED]

The output shows the service will be started when the machine is domain joined, but not when it isn't. There are also Scheduled Tasks that are responsible for starting w32time as well, but they're more readily visible via the GUI.

Another example of a service with a startup type of Manual (Trigger Start) is the Remote Registry service. Rather than this being present and running at all times, it has a trigger present:

[SC] QueryServiceConfig2 SUCCESS

SERVICE_NAME: RemoteRegistry

          NETWORK EVENT                : 1f81d131-3fac-4537-9e0c-7e7b0c2f4b55 [NAMED PIPE EVENT]
            DATA                       : winreg

This one means that when a request is made to open the named pipe 'winreg', the Remote Registry service gets started in order to service the request. You can see this in action (with the Remote Registry service not running!), by spinning up PowerShell and running this snippet of code:

PS D:\> $pipe = New-Object System.IO.Pipes.NamedPipeClientStream '.', 'winreg', 'In'
PS D:\> $pipe.Connect()
PS D:\> $pipe.Close()

Hitting F5 in the Services snap-in should now show the Remote Registry service as running which is a quick way of showing a service reacting to a trigger in action.

Other Resources

About Rob

I've been interested in computing since the day my Dad purchased his first business PC (an Amstrad PC 1640 for anyone interested) which introduced me to MS-DOS batch programming and BASIC.

My skillset has matured somewhat since then, which you'll probably see from the posts here. You can read a bit more about me on the about page of the site, or check out some of the other posts on my areas of interest.


  • Gravatar Image

    I came to this page: https://robertwray.co.uk/blog/what-does-manual-triggered-mean-for-a-windows-service
    To see what "manual" means and "manual (trigger start)" means.
    Reading what you wrote, I was disppointed.

    I did not come to read a technical reason for any of those settings, I came to find out, in simple layman's terms what those settings mean for any service in terms of booting into windows.

    Here is a suggestion:
    Provide the information in the following format,

    1. Title first (ie: Manual start)
    2. Layman's Terms - give a simple layman's explanation, be brief, no technical jargon and explanation. Just summarize in simple terms what those settings mean when booting into Windows.
    3. Technical Process - here you can explain, in technical term the reason and purpose for any start-up setting.

    The above format will serve both the basic user and the technical geek.

    The organization of the information in your current layout above is garbled, not well organized for what you tried to write about.

    Remember, your articles serve two basic types of readers, the "Non-Technical" and the "Technical", hence the format I suggested above.

  • Gravatar Image

    Hi Mark,

    Thanks for the feedback. Unfortunately as someone looking for a layman's explanation you're not who I'm targeting with my blog, hence the lack of non-technical information.

    Hopefully you still found the post in some way useful.

Add a Comment