Windows NT Services

Understand and evaluate services to improve system performance

Many services that run quietly and independently in the background support Windows NT. If you understand the functions of these services, you can improve your system's performance by running only necessary services. In this article, I will discuss what running software as a service means. I will look at some NT services and examine why they are important to the functioning of your computer and your network. Then I will show you how evaluating services with an eye toward eliminating the ones you don't need can fine-tune your system's performance.

Running as a Service
What does it mean when a program or component of NT runs as a service? Typically, when an application runs on an NT computer, the user starts it after logon. Some applications might start during the logon process if they are listed in the Startup folder. But a service program always starts independently of the logon: NT starts its service programs as part of the startup process, even if no one logs on to the computer. In the case of a computer that functions as a server, service programs must begin automatically during the startup process, because no one logs on to servers except to perform systems administration tasks (and sometimes an administrator will perform these tasks remotely).

Some NT applications, most notably BackOffice, run as services. SQL Server usually starts as a service when NT starts. Starting automatically with NT lets SQL Server process queries and act as a back-end application for clients without requiring a user to log on first. Systems Management Server (SMS) is another application that starts multiple services automatically.

Finding Your System's Services
To find out what services are running on your system, from the Start menu, select Settings and Control Panel and double-click Services. If you access Services right after you start NT, you might see the message "Service Database is locked." This message means that some services are still loading and initializing in the background, so you can't get to the list of services just yet. If you wait a few seconds, you'll be able to bring up the dialog box. NT offers another way to open this list: From the Start menu, select Programs, Administrative Tools, Server Manager. From Server Manager, select your computer, and select the Computer, Services menu item. If you have the appropriate privileges, this second method lets you see what services are running on a remote computer: Simply select the remote computer from Server Manager, and then select Computer, Services from the menu.

Screen 1, page 216, shows the Services dialog box with various services listed. The Status column tells you whether a particular service has started. The Startup column shows you whether a service is set to start automatically upon system startup or manually (manual services start when an application or another service calls them). The Startup column will also show when a service is disabled, in which case it will not start at all. The Startup button in the Services dialog box lets you modify these options, but NT usually automatically sets the options correctly at the time the service is installed (see Screen 2, page 216, to view the Startup options).

Starting and Stopping Services
Sometimes a systems administrator will need to stop and start services. For example, when you make a change to SQL Server, which is a service, you must stop SQL Server to make the change and then restart it after you've made the change. You can do the stopping and starting from the SQL Server Service Manager or Enterprise Manager, or from the Services dialog box.

To stop a highlighted service in the Services dialog box, click Stop. Click Start to start the service again. Some services take a few seconds to start and stop. If you try to start or stop a service from the Services dialog box, do not be concerned if you see a message that the service is already running. You just need to wait a few seconds. If you access the list of services from the Server Manager, you can start and stop services on another computer.

Startup Accounts. Most services use the System account to start up. In other words, they run in the security context of the NT operating system. But some services, such as the Replicator service and the SQL Server SQL Executive, need to log on with specific accounts. You set up these accounts with the appropriate group memberships in User Manager for Domains. But you must also assign each account the Log on as a service right. From within User Manager for Domains, select User Rights from the Policies menu. As Screen 3 shows, be sure to select the Show Advanced User Rights check box. Next, scroll down to the Log on as a service right and add the user account. When you assign this right to the account the service uses for logon, as shown in Screen 4, you are specifying that the service can start automatically in the background with this account, without requiring that a user take any action.

Important NT Services
You need to be familiar with three NT services: the NetLogon service, the Workstation service, and the Server service. Let's look at each of these services in detail.

The NetLogon service. The NetLogon service logs users on to the NT domain, validates usernames and passwords, and synchronizes the user accounts database between the Primary and Backup Domain Controllers (PDC and BDC). The NetLogon service is required on NT Workstation and NT Server. The NetLogon service on the workstation communicates with the NetLogon service on the domain controller to forward the logon parameters through a secure communications channel. If the NetLogon service is not running at either end of the connection, the domain controller cannot validate users. If the local NetLogon service is not running, users will not be able to log on locally or log on to the domain with cached credentials. If you pause the NetLogon service, new users will not be able to log on.

The Workstation service. The Workstation service is also known as the Redirector. It retrieves files or accesses printers from the network. It doesn't matter whether you are running NT Workstation or NT Server: As long as the Workstation service is running, you can connect to shared network resources on either NT Workstation or NT Server.

The Server service. The Server service complements the Workstation service by providing access to shared resources on the local computer. (Like the Workstation service, the Server service can run on NT Workstation or NT Server. If the computer has a shared resource, that resource is made available through the Server service.) The Server service makes announcements that list available resources to the Master Browser every 12 minutes. If the Server service is not running, users will not be able to see or connect to shared resources. Pausing the Server service will not disconnect currently connected users from shared resources, but it will prevent the establishment of any new connections.

Optimizing Services
A service that is running takes up system resources regardless of whether it is doing anything useful. Therefore, if you want to tune your system for optimum performance, consider which services you really need.

For example, you can disable the Server service on a workstation that is not sharing resources. This approach would reduce the load on the computer and reduce network traffic, because the computer would no longer announce its presence to the Master Browser every 12 minutes. A potential disadvantage to disabling the Server service on a workstation that does not share resources is that you cannot connect to the administrative shares (the C$ and D$ shares at the root of each drive) for support and backup tasks; but neither could someone who might be trying to grab files surreptitiously from that system.

You can apply the same logic to a server. If you have a server that supplies resources to the network but never connects to shared resources on other computers, you can disable the Workstation service on that server. As you consider whether to disconnect the Server and Workstation services, though, keep in mind that the question of what functions the computer is performing for the user community is not the only variable you have to think about. System functions such as Directory Replication (which is also a service) might require that the Workstation and Server services are running.

Look at the other services on your system with an eye toward optimizing total system function. For instance, you require the Alerter service only if your system receives alert notifications. You require the Schedule service only if you run unattended tasks through the AT command or some other scheduler, such as the SQL Executive. You can do a few other things to evaluate and modify your system's services.

Network Services and Bindings. You can see network-related services such as the Workstation and Server services from the Control Panel, Network, Services dialog box, shown in Screen 5. The Network Services dialog box is where you must go to install other network services, such as Dynamic Host Configuration Protocol (DHCP), Windows Internet Name Service (WINS), and Domain Name System (DNS), all of which run in the background as NT services.

Look at the Bindings tab in the Network dialog box (shown in Screen 6). Each of the displayed services is bound to certain protocols. Here is an opportunity to fine-tune your system, because not every service must be bound to all protocols and adapters. Suppose you have installed the NWLink protocol and File and Print services for Novell NetWare so that your server can support NetWare clients. The Server service must be bound to the NWLink protocol so that NetWare clients can request the File and Print services. But you don't need to bind the Workstation service on the server to the NWLink protocol, because the Workstation service will never request resources from the NetWare clients. Disabling this binding, as shown in Screen 6, will improve system performance. Yes, this improvement might be slight, but every little gain will help overall system performance.

Services and Hardware Profiles. You can configure a service to start on a specific hardware profile. (For more on hardware profiles, see "Configuring Hardware Profiles," September 1997.) If you configure only the services you need for each hardware profile, you can improve system performance. For example, the Messenger service will try to start on a computer with a network-disabled profile, and of course it will fail. But because the network-disabled computer is not connected to the network, it won't be able to receive alerts from the network, so you could turn off the Messenger service (this probably should happen automatically when you select a network-disabled profile, but it doesn't).

Don't assume that you need to keep all services running in every computing situation. If you understand what each service does in your system and when it is and isn't needed, you can significantly improve the performance and efficiency of your system.