0

I disabled the AD service on a production server on 23/07/2019. I picked up the service was restarted on the 25/07/2019. When I came to discover was that the service was used the following day around 7:52AM by users in the application.

Is it possible that the windows update restarts services without user consent.

  • 1
    Welcome to SuperUser. Can you find the entry in the Event Viewer that corresponds to you disabling the service? Is it possible that you accidentally just stopped it instead of disabling it. Then, find the entry in the Event Viewer for when it started. And perhaps for when it was changed to Automatic or Manual. Changes to or from Disabled, Automatic ("auto start") and Manual ("demand start") will be Event ID 7040. – Doug Deden Aug 01 '19 at 13:19
  • Happy to be here, Thanks for the information. I managed to find the event where I stopped it. I did not disable the service, it was still set to automatic. I was instructed to just stop the service, not fully disable it. According to the audits the service was restarted a day later it was utilized and just remained on. If someone with access pushes a request to the service, knowing that it was stopped at that time but was still set to automatic, does the automatic setting allow the AD service to be re-activated(auto started). If that is the case then the automatic (auto start) was the issue. – goldenfishboy Aug 06 '19 at 14:16

1 Answers1

0

Does Windows Update restart services without consent?

Well, Windows Update can do pretty much anything it wants, including installing, removing, or reconfiguring services. But if the updates in question didn't specifically involve the service in question, it is unlikely that the update process itself restarted a service. Particularly one that was set to Disabled. However, the Windows Update process involves a reboot most of the time, and the reboot will restart the service if the service was stopped but left in Automatic mode. (And a reboot could also trigger other actions that would cause even a Manual service to start.)

From your follow-up comment, we learn that you stopped the service, but did not disable it. Thus the service was set to either Manual or Automatic. Either way, it is reasonable to find it with a status of Running later.

If it was left at Manual:

A service set to Manual will start when either Windows or some other service needs it to be running, or when a user runs something that starts the service. In your case, this could have happened if another process needed the service, even in the absence of a reboot.

If it was left at Automatic:

A service set to Automatic will start when Windows boots up. Or, if it is stopped some time after boot-up, it will start when some other service needs it to be running, or when a user runs something that starts the service. In your case, this could have happened if your Windows Updates involved a reboot.

See also:

This question about the differences between Automatic, Manual, and Disabled

Doug Deden
  • 1,989
  • 1
  • 10
  • 16