How to Install a Windows Service: sc.exe, PowerShell, NSSM

A Windows service is a background process that runs without user interaction, managed by the Service Control Manager (SCM). Services power critical system functions like web servers, databases, monitoring tools, and custom applications that need to start automatically and run continuously in the background.

This guide covers three proven methods to install Windows services: sc.exe (the native command-line tool), PowerShell’s New-Service cmdlet (for modern automation), and NSSM (Non-Sucking Service Manager, which wraps any executable as a service). Whether you’re a system administrator deploying production services or a developer testing custom applications, you’ll learn the complete installation lifecycle including security hardening, troubleshooting, and monitoring.

To install a Windows service, use one of three methods: sc.exe (native command-line tool), PowerShell’s New-Service cmdlet, or NSSM (for non-service executables). All methods require administrator privileges. Use sc create [ServiceName] binPath= [PathToExecutable] for sc.exe, New-Service -Name [ServiceName] -BinaryPathName [Path] for PowerShell, or nssm install [ServiceName] for NSSM. Verify installation via services.msc or Get-Service.

Prerequisites & Permissions

Before installing a Windows service, verify you have the necessary permissions and environment:

Administrative privileges are mandatory. Service installation requires User Account Control (UAC) elevation. Right-click Command Prompt or PowerShell and select “Run as administrator.”

Executable requirements: Your service binary must be a valid Windows service executable (.exe) that implements the Service Control Manager interface. For non-service executables like Java applications, Python scripts, or Node.js servers, use NSSM (covered in Method 3).

Environment compatibility: This guide covers Windows Server 2016/2019/2022 and Windows 10/11. All three methods work identically across these platforms.

Service account planning: Decide which account will run your service. Options include LocalSystem (full privileges, security risk), LocalService (minimal local privileges), NetworkService (minimal privileges with network access), or custom user accounts with scoped permissions. The principle of least privilege dictates using the minimum permissions necessary.

Test before production: Always test service installation and operation in a non-production environment first to verify functionality and security configurations.

Method 1 — Installing Windows Services with sc.exe Command

Understanding sc.exe Syntax

The sc.exe utility is Windows’ built-in Service Control command-line tool. It creates registry entries and Service Control Manager database entries for new services.

Basic command structure:

sc create [ServiceName] binPath= [PathToExecutable]

Critical syntax note: A space is required after the = sign in all parameters. binPath=[path] fails, while binPath= [path] succeeds.

Common parameters:

• binPath= (REQUIRED) — Full path to the service executable. Enclose paths with spaces in quotes: binPath= "C:\Program Files\MyApp\service.exe"
• start= — Startup type: auto (automatic), demand (manual), disabled, delayed-auto (delayed automatic start, ~2 minutes after boot)
• DisplayName= — Friendly name shown in Services console
• depend= — Service dependencies (services that must start first), separated by forward slashes
• obj= — Service account username (default: LocalSystem)
• password= — Service account password (required if using custom account)

Step-by-Step: Creating a Service with sc.exe

1. Open Command Prompt as Administrator: Press Windows key, type “cmd,” right-click “Command Prompt,” select “Run as administrator.”
2. Create the service: Use the basic syntax with your service executable path. Example:

sc create MyService binPath= "C:\Services\MyService.exe" start= auto DisplayName= "My Custom Service"

3. Verify creation: Query the service status:

sc query MyService

You should see the service listed with STATE: STOPPED.

4. Start the service:

sc start MyService

5. Confirm it’s running:

sc query MyService

The output should show STATE: RUNNING if startup succeeded.

Advanced sc.exe Configurations

Setting service dependencies: If your service requires another service (e.g., network services):

sc create MyService binPath= "C:\Services\MyService.exe" depend= LanmanWorkstation/Netlogon

Configuring recovery options: Set the service to restart automatically on failure:

sc failure MyService reset= 86400 actions= restart/60000/restart/120000/restart/300000

This restarts the service after 1 minute on first failure, 2 minutes on second failure, 5 minutes on third failure, with a 24-hour (86400 seconds) reset period.

Using a custom service account:

sc create MyService binPath= "C:\Services\MyService.exe" obj= "DOMAIN\ServiceAccount" password= "SecurePassword123"

Delayed auto-start (reduces boot time congestion for non-critical services):

sc create MyService binPath= "C:\Services\MyService.exe" start= delayed-auto

Modifying and Deleting Services with sc.exe

Change startup type:

sc config MyService start= demand

Update service description:

sc description MyService "This service handles background data processing"

Delete a service (must stop it first):

sc stop MyService
sc delete MyService

Important: Attempting to delete a running service returns Error 1072. Always stop services before deletion.

Method 2 — Installing Windows Services with PowerShell

Why Use PowerShell for Service Management

PowerShell’s New-Service cmdlet offers advantages for modern Windows environments:

• Automation-friendly: Integrates seamlessly with PowerShell scripts for bulk deployments
• Better credential handling: PSCredential objects avoid storing passwords in plain text
• Native on modern Windows: Built into Windows Server 2016+ and Windows 10+
• Object-oriented output: Returns service objects for pipeline integration

Step-by-Step: Creating a Service with New-Service

1. Open PowerShell as Administrator: Press Windows key, type “PowerShell,” right-click “Windows PowerShell,” select “Run as administrator.”
2. Basic service creation:

New-Service -Name "MyService" -BinaryPathName "C:\Services\MyService.exe" -StartupType Automatic

3. With additional configuration:

$params = @{
    Name = "MyService"
    BinaryPathName = "C:\Services\MyService.exe"
    DisplayName = "My Custom Service"
    Description = "Handles background data processing tasks"
    StartupType = "Automatic"
}
New-Service @params

4. Using a service account with PSCredential:

$cred = Get-Credential
New-Service -Name "MyService" -BinaryPathName "C:\Services\MyService.exe" -Credential $cred -StartupType Automatic

This prompts for the service account username and password, storing them securely in a PSCredential object.

5. Start and verify the service:

Start-Service -Name "MyService"
Get-Service -Name "MyService"

Managing Services with PowerShell Cmdlets

PowerShell provides comprehensive service management cmdlets:

Query service status:

Get-Service -Name "MyService"

Start, stop, restart:

Start-Service -Name "MyService"
Stop-Service -Name "MyService"
Restart-Service -Name "MyService"

Modify service properties:

Set-Service -Name "MyService" -StartupType Manual -Description "Updated description"

Remove a service: PowerShell doesn’t have a native Remove-Service cmdlet in all Windows versions. Use sc.exe:

sc.exe delete MyService

Bulk operations example (start all services matching a pattern):

Get-Service -Name "MyApp*" | Start-Service

Method 3 — Installing Non-Standard Executables with NSSM (Non-Sucking Service Manager)

What is NSSM and When to Use It

NSSM (Non-Sucking Service Manager) wraps any executable as a Windows service, even if it wasn’t designed as a service. This solves a common problem: most applications (Java JARs, Python scripts, Node.js servers, batch files) don’t implement the Service Control Manager interface required for native Windows services.

NSSM advantages:

• Wraps ANY executable (including scripts and interpreted applications)
• Handles stdout/stderr logging automatically
• Automatic restart policies with throttling
• Graceful shutdown management
• Free and open-source

Use cases: Java applications, Python scripts, Node.js web servers, batch automation, forex trading bots, SEO monitoring tools — any application that needs to run as a background service.

Installing NSSM

Option 1 — Manual download:

1. Download from https://nssm.cc/download
2. Extract to C:\nssm\ (or add to system PATH)
3. Use the version matching your architecture (win32 or win64)

Option 2 — WinGet (Windows Package Manager):

winget install NSSM.NSSM

Verify installation:

nssm --version

Step-by-Step: Creating a Service with NSSM

GUI Mode (recommended for first-time setup):

1. Open Command Prompt or PowerShell as Administrator
2. Run: nssm install MyService
3. The NSSM GUI appears with multiple configuration tabs:

Application tab:

• Path: Browse to your executable (e.g., C:\Python39\python.exe)
• Startup directory: Working directory for your application
• Arguments: Command-line arguments (e.g., C:\Scripts\myapp.py)

Details tab:

• Display name: Friendly name
• Description: Service description
• Startup type: Automatic, Manual, Disabled, or Automatic (Delayed Start)

Log on tab:

• Service account (default: LocalSystem, or specify custom account)

I/O tab (critical for logging):

• Output (stdout): C:\Logs\MyService-output.log
• Error (stderr): C:\Logs\MyService-error.log

Exit actions tab:

• Configure restart behavior on crashes
• Throttle restart attempts to prevent infinite loops

4. Click “Install service”

CLI Mode (for automation/scripts):

nssm install MyService "C:\Python39\python.exe" "C:\Scripts\myapp.py"
nssm set MyService AppDirectory "C:\Scripts\"
nssm set MyService DisplayName "My Python Service"
nssm set MyService Description "Python-based background processor"
nssm set MyService Start SERVICE_AUTO_START
nssm set MyService AppStdout "C:\Logs\MyService-output.log"
nssm set MyService AppStderr "C:\Logs\MyService-error.log"

Start the service:

nssm start MyService

Verify:

sc query MyService

NSSM Advanced Features

Output redirection for logging: NSSM automatically captures stdout and stderr to log files:

nssm set MyService AppStdout "C:\Logs\service-output.log"
nssm set MyService AppStderr "C:\Logs\service-error.log"

Service restart policies: Configure restart behavior with throttling to prevent rapid failure loops:

nssm set MyService AppThrottle 1500

This prevents the service from restarting more than once every 1500 milliseconds.

Environment variables:

nssm set MyService AppEnvironmentExtra "NODE_ENV=production"

Log rotation (prevent infinite log file growth):

nssm set MyService AppRotateFiles 1
nssm set MyService AppRotateOnline 1
nssm set MyService AppRotateSeconds 86400
nssm set MyService AppRotateBytes 10485760

This rotates logs daily (86400 seconds) or when they exceed 10MB, whichever comes first.

Security Best Practices for Windows Services

Service security is critical because services often run with elevated privileges and have persistent access to system resources.

Principle of Least Privilege

Never run services as LocalSystem unless absolutely required. LocalSystem has unrestricted access to the entire system, making it a prime target for privilege escalation attacks.

Recommended service accounts:

• LocalService: Minimal privileges on the local computer only. Cannot authenticate to network resources. Use for services that only need local access.
• NetworkService: Minimal privileges with the ability to authenticate to network resources using the computer account. Use for services that access network resources but don’t need administrative rights.
• Custom domain/local user: Create a dedicated service account with only the permissions needed for the specific service. This is most secure and auditable.

According to Microsoft’s service account security guidance, using dedicated service accounts allows administrators to:

• Apply precise permission scoping
• Audit service account activity through Windows Security logs
• Disable accounts immediately if compromise is suspected
• Rotate credentials on a schedule without system-wide impact

Password and Credential Security

Avoid hardcoding passwords in scripts. Use PowerShell PSCredential objects, Group Policy Preferences (with caution), or Managed Service Accounts (gMSA/sMSA) for automated password management.

For production environments, consider Group Managed Service Accounts — domain accounts with automatic password rotation, eliminating manual credential management.

File System Permissions

Restrict access to service executables and configuration files:

• Set NTFS permissions so only Administrators and SYSTEM can modify the service executable
• Remove write permissions for standard users
• Audit access to service directories (Event Viewer → Security logs)

Example: For a service at C:\Services\MyService.exe, remove the Users group’s modify permissions:

1. Right-click the executable → Properties → Security tab
2. Remove “Users” group or set to Read & Execute only
3. Ensure only Administrators and SYSTEM have Full Control

Security Checklist for Production Deployment

• [ ] Service runs under a dedicated account (not LocalSystem)
• [ ] Service account has only minimum required permissions
• [ ] Service executable directory permissions limited to Administrators + SYSTEM
• [ ] No hardcoded passwords in scripts or configuration files
• [ ] Security auditing enabled for service account activity
• [ ] Regular security patch schedule for service dependencies
• [ ] Service configured to restart automatically on failure (prevents DoS via crash)
• [ ] Log files secured with appropriate NTFS permissions

Troubleshooting Common Errors

Error 1053: The service did not respond in a timely fashion

Cause: The executable doesn’t implement the Service Control Manager interface, crashes immediately on startup, or takes too long to initialize.

Solutions:

1. Check Event Viewer: Open Event Viewer (eventvwr.msc) → Windows Logs → Application. Look for crash details or error messages from your service.
2. Test the executable manually: Run the service executable from the command line to verify it works standalone. If it crashes or requires user input, it’s not suitable as a native Windows service.
3. Use NSSM for non-service executables: If the application wasn’t designed as a Windows service, wrap it with NSSM instead of using sc.exe or New-Service.
4. Increase timeout (last resort): If the service legitimately needs more than 30 seconds to start, increase the Service Control Manager timeout. Edit the registry: HKLM\SYSTEM\CurrentControlSet\Control → Create DWORD ServicesPipeTimeout → Set value to timeout in milliseconds (e.g., 60000 for 60 seconds). Reboot required.

Error 1072: The specified service has been marked for deletion

Cause: The service was deleted, but the Services console (services.msc) is still open, holding a stale handle.

Solutions:

1. Close services.msc completely
2. Refresh or reboot the server
3. The service entry will disappear on next Services console refresh

Error 5: Access Denied

Cause: Insufficient permissions. The command prompt or PowerShell session is not running with administrator privileges.

Solution: Close the current session and reopen Command Prompt or PowerShell as Administrator (right-click → Run as administrator). UAC elevation is mandatory for service installation.

Service Starts Then Immediately Stops

Causes and solutions:

• Missing dependencies: Verify all DLLs and configuration files the service needs are present. Use Dependency Walker to check for missing DLLs.
• Incorrect binPath: Ensure the binPath= parameter points to a valid executable with correct path syntax (quotes if spaces present).
• Service account lacks permissions: The service account may not have Read & Execute permissions on the executable or its dependencies. Verify NTFS permissions.
• Application error: Check Event Viewer (eventvwr.msc → Windows Logs → Application) for detailed error messages. The service may be crashing due to application bugs.

Diagnostic steps:

1. Run the executable manually from Command Prompt to test functionality
2. Check Event Viewer for crash details
3. Verify service account has Read & Execute on the executable directory
4. Test with LocalSystem account temporarily to rule out permission issues (switch back to least-privilege account after diagnosis)

Service Won’t Start After Reboot

Causes:

• Dependency services not started: Services the application depends on may not be available during boot.
• Network resources unavailable: The service tries to access network shares or databases before networking is fully initialized.

Solutions:

1. Use Delayed Automatic startup: This starts the service ~2 minutes after boot, when networking and dependencies are stable:

sc config MyService start= delayed-auto

Or in PowerShell:

Set-Service -Name "MyService" -StartupType AutomaticDelayedStart

2. Configure service dependencies correctly: Specify which services must start first using the depend= parameter (sc.exe) or -DependsOn (PowerShell).
3. Set recovery options: Configure automatic restart on failure:

sc failure MyService reset= 86400 actions= restart/60000

Monitoring and Managing Installed Services

Services Console (services.msc)

The graphical Services console provides an overview of all services:

1. Press Windows key + R, type services.msc, press Enter
2. Browse the list to find your service
3. Double-click to view properties, set startup type, configure recovery options, and view dependencies

Event Viewer Integration

Windows logs service start/stop events and errors:

1. Open Event Viewer (eventvwr.msc)
2. Navigate to Windows Logs → Application
3. Filter by source or search for your service name
4. Review error messages, crash details, and startup events

Tip: Configure Event Viewer to send email alerts on critical service failures using Task Scheduler integration.

Task Manager Quick Status

For a quick service status check:

1. Press Ctrl + Shift + Esc to open Task Manager
2. Click the “Services” tab
3. Find your service by name
4. Right-click to start, stop, or restart

PowerShell Monitoring Script

Automate service health checks with PowerShell:

# Check critical service status
$services = @("MyService", "AnotherService")
foreach ($svc in $services) {
    $status = Get-Service -Name $svc -ErrorAction SilentlyContinue
    if ($status.Status -ne 'Running') {
        Write-Warning "Service $svc is not running! Status: $($status.Status)"
        # Send alert email, restart service, or log to monitoring system
    }
}

Schedule this script with Task Scheduler to run every 5 minutes for automated monitoring.

Service Recovery Actions

Configure automatic restart on failure to maximize uptime:

1. Open services.msc
2. Double-click your service → Recovery tab
3. Set actions for First failure, Second failure, Subsequent failures (options: Restart the Service, Run a Program, Restart the Computer)
4. Set restart delay (e.g., 1 minute)

Or via command line:

sc failure MyService reset= 86400 actions= restart/60000/restart/120000//

Verifying Service Installation Checklist

Before considering your service installation complete, verify:

1. Service appears in services.msc — Open Services console and confirm your service is listed
2. Service starts successfully — Use sc start [ServiceName] or Start-Service with no errors
3. Service shows “Running” status — Verify with sc query [ServiceName] or Get-Service
4. Service survives reboot — Restart the server and confirm automatic startup (if configured as Automatic or Delayed Automatic)
5. Event Viewer shows no errors — Check Windows Logs → Application for crash or error messages
6. Service logs are being written — If you configured output redirection (NSSM) or custom logging, verify log files exist and contain expected output
7. Application functionality works — Test the actual purpose of the service (e.g., if it’s a web server, access the website; if it’s a data processor, verify data processing occurs)
8. Service account has minimal permissions — Confirm the service runs under LocalService, NetworkService, or a custom account (not LocalSystem), and audit its permissions

When to Use Each Method (Decision Matrix)

Use sc.exe when:

• You need a simple, one-time service installation
• The executable is a native Windows service binary
• You’re working in a command-line only environment (no PowerShell)
• You’re automating with batch scripts (.bat or .cmd files)
• You prefer native Windows tools with no third-party dependencies

Use PowerShell when:

• You’re deploying services across multiple servers (bulk operations)
• You need secure credential management with PSCredential objects
• You’re working in modern Windows Server environments (2016+)
• You’re integrating service management into larger PowerShell automation workflows
• You want object-oriented service management for pipeline processing

Use NSSM when:

• Your executable is NOT a native Windows service (Java, Python, Node.js, batch files)
• You need automatic stdout/stderr logging to files
• You require automatic restart policies with throttling
• The application needs complex command-line arguments or environment variables
• You want graceful shutdown handling for applications that don’t respond to Windows service stop signals

Frequently Asked Questions

Can I install a service without administrator rights?

No. Service installation requires administrator privileges due to the system-level changes involved (registry modifications, Service Control Manager database updates). You must run Command Prompt or PowerShell as Administrator (UAC elevation required). There is no workaround for this security requirement.

How do I uninstall a Windows service?

Stop the service first, then delete it. Using sc.exe:

sc stop MyService
sc delete MyService

Using NSSM:

nssm stop MyService
nssm remove MyService confirm

The confirm parameter suppresses the GUI confirmation dialog for automated scripts.

What’s the difference between Automatic and Automatic (Delayed Start)?

Automatic services start immediately during boot, as soon as their dependencies are met. Automatic (Delayed Start) services wait approximately 2 minutes after boot before starting, reducing boot time congestion and ensuring network resources are fully available. Delayed start is recommended for non-critical services that don’t need to start immediately on boot (e.g., monitoring tools, background processors).

Can I run a Python script as a Windows service?

Yes, but not directly with sc.exe or New-Service. Python scripts require the Python interpreter to run, so you must wrap the interpreter and script together using NSSM:

nssm install MyPythonService "C:\Python39\python.exe" "C:\Scripts\myapp.py"

NSSM handles launching the Python interpreter with your script as an argument, capturing output to log files, and managing the process lifecycle.

Where can I view service error logs?

Event Viewer: Press Windows key + R, type eventvwr.msc, press Enter. Navigate to Windows Logs → Application. Filter by your service name or source.

NSSM custom logs: If you configured NSSM with stdout/stderr redirection, check the log file paths you specified (e.g., C:\Logs\MyService-error.log).

Application-specific logs: Some services write to their own log files or databases. Check your application’s documentation for log file locations.

Deploy Your Windows Services with Confidence

You now have three proven methods to install Windows services: sc.exe for native services, PowerShell for automation, and NSSM for wrapping any executable. Combined with security best practices, troubleshooting techniques, and monitoring strategies, you can deploy production-ready services on Windows Server or Windows desktop environments.

Need a reliable Windows Server environment to deploy your services? Explore our Windows RDP hosting plans starting at $4.99/mo with full Windows licensing, 99.99% uptime guarantee, and 24/7 support. Whether you’re deploying production services on a remote Windows Server or running background automation for forex trading, SEO tools, or custom applications, our Windows RDP plans provide the performance and reliability you need.

For Linux-based services, check out our Cloud VPS hosting from $5.99/mo with SSD storage, scalable resources, and the same 99.99% uptime guarantee and 24/7 support.

Sources

1. Microsoft Learn – sc.exe create command — Official documentation for sc.exe command syntax and parameters
2. Microsoft Learn – New-Service PowerShell cmdlet — Official PowerShell cmdlet reference for service creation
3. Microsoft Learn – Service Accounts in Windows Server — Security guidance for service account types and best practices
4. NSSM – Usage Documentation — Official NSSM installation and configuration guide
5. Microsoft Learn – Group Managed Service Accounts Overview — Automated password management for production environments