Disabling the service with Windows 10

[tiual]

Hi! When working with Windows 10, every time you restart your PC, I get a message that I need to install the service or run it as an administrator. The option to install the service disappears after a reboot and this message appears again. In Windows 7, this was not the case. How to fix the situation? Thanks!

[void]

Please try installing the Everything Service:

• In Everything, from the Tools menu, click Options.
• Click the General tab on the left.
• Check Everything service (Please make sure this is tick-checked and not square checked).
• Check Run Everything on system startup (Please make sure this is tick-checked and not square checked).
• Uncheck Run as administrator.
• Click OK.
• Exit Everything (right click the Everything tray icon and click Exit).
• Restart Everything.

[tiual]

I always set these settings. But each time after restarting the PC, the service is disabled and the window appears again.

[void]

The Everything Service might be crashing?
There might be a third party app disabling the service?

Are there any reports in Event Viewer for the Everything Service?

• From the Start menu, run Event Viewer.
• On the left, navigate to Windows Logs\System.
• Press Ctrl + F to open the Find dialog..
• Change Find what to: Everything
• Click Find Next.
• Are any results found?

Please try running the Everything Service in session 1 and in debug mode:

• Make sure the Everything Service is not running.
• Open the Task Manager with Ctrl + Shift + ESC.
• Click the Services tab.
• Select Everything (if it exists), right click Everything and click Stop Service.
• Run Everything.exe as an administrator with the following command line options:
  Everything.exe -svc -debug
• Does your Everything client run as a standard user now? -If not what is shown in the service debug console?

[tiual]

This happens on 3 different PCs. I think there are no third-party applications that disable the service. Maybe Windows does this?
Event Viewer shows warnings:
'Failed to restart the app "C:\Program Files\Everything\Everything.exe" (process ID 7468) - the application's security ID does not match the conductor's security ID..'

Debug console shows:
Everything
Version 1.4.1.935 (x64)
Windows NT 6.2
Processors 4
IsAdmin 1
AppData 0
Service 2
cmdline "C:\Program Files\Everything\Everything.exe" -svc -debug
StartServiceCtrlDispatcher Everything
_service_server_main
createnamedpipe \\.\PIPE\Everything Service
awake
connect...
sleep 2 0

[NotNull]

Maybe there is some misconfiguration in your Everything service.
You can let Everything re-create the service from scratch:

• Start Everything
• Go to Menu:Tools > Options > General
  (just to be complete .. I *think* you know that by now )
• Uncheck Everything Service
• Click OK (not Apply)
• Answer the User Account Control prompt
• Go to Menu:Tools > Options > General
• Check Everything Service
• Click OK
• Answer the User Account Control prompt
• Exit Everything
• Restart your computer

Does this solve your issue?

[void]

Thanks for the service debug log. -This shows the Everything Service is starting successfully as a standard program.
So it must be an issue with running as a service.

Are these computers on a domain?

Could be the Everything code signing certificate -Does the latest nightly build help?

What version of Windows are you using? (Start -> Run -> winver)

[tiual]

Computers are not in the domain.
Nightly build has the same problem.
Windows 10 Pro and Home 1909

[therube]

Are you using the (Everything) MSI Installer?

Does the same issue occur if you use the "Portable" ZIP version, unzip & run?

[tiual]

The portable version has the same problem.

[void]

Could you please try running the Everything Service in debug logging mode:

• From the Start menu, click Run....
• Type in regedit and click Run.
• In Regedit, navigate to:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Everything
• Change the value data for ImagePath from
  "C:\Program Files\Everything\Everything.exe" -svc
  to:
  "C:\Program Files\Everything\Everything.exe" -svc -debug-log
  where "C:\Program Files\Everything\Everything.exe" is the location of your Everything.exe
• Press Ctrl + Shift + ESC to start the Task manager
• Click the Services tab.
• Right click Everything and click Stop Service.
• Right click Everything and click Start Service.
• Restart Everything.

When the Everything service debug logging is enabled, all debug messages are logged to C:\Windows\Temp\Everything Service Debug Log.txt
Could you please send me this file after a reboot?

To disable the Everything service debug mode:

• Press Ctrl + Shift + ESC to start the Task manager
• Click the Services tab.
• Right click Everything and click Stop Service.
• In Everything, from the Tools menu, click Options.
• Click the General tab on the left.
• Check Everything Service (please make sure it is tick-checked and not square checked)
• Click OK.

[tiual]

There is:

2020-01-24 16:27:20.544: Everything
2020-01-24 16:27:20.569: Version 1.4.1.935 (x64)
2020-01-24 16:27:20.586: Windows NT 6.2
2020-01-24 16:27:20.603: Processors 4
2020-01-24 16:27:20.619: IsAdmin 1
2020-01-24 16:27:20.636: AppData 0
2020-01-24 16:27:20.669: Service 2
2020-01-24 16:27:20.687: cmdline "E:\Program Files\Everything\Everything.exe" -svc -debug-log
2020-01-24 16:27:20.723: StartServiceCtrlDispatcher Everything
2020-01-24 16:27:20.756: _service_server_ctrl_dispatcher
2020-01-24 16:27:20.789: _service_server_main
2020-01-24 16:27:20.822: RegisterServiceCtrlHandlerEx Everything 00000000005730a0
2020-01-24 16:27:20.856: createnamedpipe \\.\PIPE\Everything Service
2020-01-24 16:27:20.879: awake
2020-01-24 16:27:20.906: connect...
2020-01-24 16:27:20.929: sleep 2 0

[void]

Thanks for the debug log.

This shows the Everything Service is started successfully.

What happens if you launch the Everything search client now?
Is the Access dialog shown again?

What is shown in the C:\Windows\Temp\Everything Service Debug Log.txt after starting the Everything search client?

[tiual]

Yes, the Access dialog shown again. There is

[void]

Thanks for the debug log.

The debug log shows the Everything client connecting to the Everything service successfully and disconnecting from the Everything service successfully.

The access denied dialog is shown when the following conditions are met:

• Opening a volume for read access failed (Error 5: access denied)
• Everything is not running as an administrator.
• The Everything Service is not installed or is not running.

If all the conditions are met, the dialog is shown.

Could you please re-install the Everything Service (to disable debug logging):

• In Everything, from the Tools menu, click Options.
• Click the General tab on the left.
• Check Everything service.
• Uncheck Run as administrator.
• Click OK.
• From the Tools menu, click Options.
• Is Everything service tick-checked or square-checked? -Square-checked means the Everything Service is partially installed or is installed and is not running. -Tick-checked means the Everything Service is installed and running.

If the Everything Service is installed and running (Tools -> Options -> General -> Everything Service -> Tick-checked) and you restart Everything (Right click the Everything system tray icon and click Exit), is the access denied dialog shown? or does this only occur after a PC restart?

If the issue persists could you please send the debug output from the search client:

• Completely exit Everything (Right click the Everything system tray icon and click Exit)
• From a command prompt navigate to your Everything.exe location, eg:
  cd c:\program files\everything
• Run the following command:
  Everything.exe -debug-log
• After the access denied dialog is shown, could you please send your %TEMP%\Everything Debug Log.txt

The USN Journal could be in a bad state? -try deleting the usn journal and recreating it:

• In Everything, from the Tools menu, click Options.
• Click the NTFS tab on the left.
• Select your C: drive.
• Uncheck Enable USN Journal.
• Click OK.
• Restart your PC.
• In Everything, from the Tools menu, click Options.
• Click the NTFS tab on the left.
• Select your C: drive.
• Check Enable USN Journal.
• Check Monitor changes.
• Click OK.

[tiual]

There is. After reboot the service is disabled.

[NotNull]

This stands out to me:

cmdline "C:\Program Files\Everything\Everything.exe" -svc -debug
vs.
cmdline "E:\Program Files\Everything\Everything.exe" -svc -debug-log

Debug console shows:
Everything
Version 1.4.1.935 (x64)
Windows NT 6.2
Processors 4
IsAdmin 1
AppData 0
Service 2
cmdline "C:\Program Files\Everything\Everything.exe" -svc -debug

2020-01-24 16:27:20.544: Everything
2020-01-24 16:27:20.569: Version 1.4.1.935 (x64)
2020-01-24 16:27:20.586: Windows NT 6.2
2020-01-24 16:27:20.603: Processors 4
2020-01-24 16:27:20.619: IsAdmin 1
2020-01-24 16:27:20.636: AppData 0
2020-01-24 16:27:20.669: Service 2
2020-01-24 16:27:20.687: cmdline "E:\Program Files\Everything\Everything.exe" -svc -debug-log

[tiual]

I tried with portable version also

[void]

Please try re-installing Everything on your C: drive.

After a reboot, what is status for the Everything service:

• In the Task Manager (Ctrl + Shift + ESC), click the Services tab.
• Click the Services... button.
• Select the Everything Service.
• What is the Status? eg: Started / Blank ?
• What is the Startup Type: eg: Manual / Disabled / Automatic ?

[tiual]

I tried re-installing on C: drive.
After reboot Status: stopped, Startup Type: Manual

[void]

Please try changing the startup type to automatic and see if your change persists after a reboot:

• From the Task Manager (Ctrl + Shift + ESC), click the Services tab.
• Click the Services button.
• Select the Everything Service.
• Right click the Everything Service and click Properties.
• Change Startup type to Automatic.
• Click OK.
• Restart your PC.
• In the Task Manager (Ctrl + Shift + ESC), click the Services tab.
• Click the Services... button.
• Select the Everything Service.
• What is the Status? eg: Started / Blank ?
• What is the Startup Type: eg: Manual / Disabled / Automatic ?

Something is most likely disabling the Everything Service. Please check if your anti-virus is disabling the Everything Service.

[tiual]

Startup Type: Stopped

[NotNull]

Startup Type: Stopped

That is the status, not the startup type

[tiual]

I changed Startup type to Automatic and started service. After reboot: Status: Stopped, Startup Type:: Manual

[horst.epp]

I changed Startup type to Automatic and started service. After reboot: Status: Stopped, Startup Type:: Manual

So something in your system is strange because the setup of Everything can't be responsible for that behaviour.
Also we don't see more users complaining about such a problem and I guess the majority make use of the service.
May be time for installing a fresh copy of Windows or to remove some tools which try to watch services.

[froggie]

What anti-virus are you using? More than one?
Can you try disabling anti-virus and then repeating the set Everything service to automatic & reboot test.

[tiual]

I use only one: 360 Total Security. But it is always disabled.

[tiual]

I changed Startup type to Automatic and started service. After reboot: Status: Stopped, Startup Type:: Manual

So something in your system is strange because the setup of Everything can't be responsible for that behaviour.
Also we don't see more users complaining about such a problem and I guess the majority make use of the service.
May be time for installing a fresh copy of Windows or to remove some tools which try to watch services.

Hi friend! I have 3 workstations with the same trouble with windows 10. All of them I installed and the problem was from beginning. I'm a system administrator and I know what I'm saying. I thing Win 10 disables this service, but I don't know why. It is the only service it disables.

[void]

Are all these computers on a domain?

There might be a Computer GPO that disables the service?

Are you using the same version of Windows? And what version of Windows are you using? (Start -> Run -> winver )

[tiual]

My computers is not on domain. GPO.. may be, but I do not know where I must search. Windows 10 Pro 1909. I think maybe one of programs disables the service. I installed Win 10 on new PC and there aren't this problem. I try find it.

[NotNull]

Sysinternals' Autoruns can help you finding (non-Microsoft) programs that run at startup and might disable the Everything service.
You can also (temporary) disable these startup programs with Autoruns.

[tiual]

I found a problem. This service was disabled by 360 Total Security antivirus, although it was disabled. After removing the antivirus, the problem disappeared. Thanks!

[NotNull]

I found a problem. This service was disabled by 360 Total Security antivirus, although it was disabled. After removing the antivirus, the problem disappeared. Thanks!

Thanks for letting everyone know! That will help other people in a similar situation.


Could you tell us what edition/version of 360 Total Security antivirus you are/were using, so we can let the author know of this shortcoming in their product?

[tiual]

It was 360 Total Security Free version 10.6.0.1210. I deinstalled it and installed again last version 10.6.0.1338. The problem was gone. But when I updated to last version without deinstall, the problem remained. I don't know if the problem will show up again, time will tell.

[NotNull]

Thanks!

A report has been sent to 360 Total Security.