Are Start=3 (manual) services (at least partly) preloaded?

[dencorso]

Services can be set to Start=0 (boot), loaded before ntoskrnl, Start=1 (system) loaded by ntoskrnl, and Start=2 (automatic), loaded around winlogon time and Start=4 (disabled) never loaded. Now, what exactly is the fate of Start=3 (manual) services? Are they (i) left alone until needed, or (ii) first initialized, then deactivated until needed, or even (iii) initialized and left in a twilight state in which they are not actually "started", but still have an active part in memory waiting an order to start?

[allen2]

From what i know, they are deactivated until needed BUT sometimes some services set to automatic launch manual ones (so you get some manual services always started if don't disable them or don't set as manual the services launching them).

Also the services using svchost are behaving differently (several services might use the same svchost process).

[jaclaz]

I would add that some Services, besides the "dependency" problems allen2 pointed out , tend to re-set themselves.

The USBbootwatcher service:

http://www.911cd.net/forums//index.php?showtopic=22473&hl=

besides it name (due to the fact that it was born to reset some drivers that Windows XP normally "forces" to 3) can set *any* service to *any* value during boot, compare with:

http://www.911cd.net/forums//index.php?showtopic=22473&st=23

so it can be useful even outside or beyond it's original scope.

jaclaz

Edited March 17, 2011 by jaclaz

[cluberti]

To answer the original question though, any service that is set to Manual (that has no dependency that causes it to start anyway) does not load in any way - I suppose it could get cached by the prefetcher and superfetch if it runs regularly, but as to being loaded, no.