Monday, 10 August 2026

How to update a Windows Service

 I've been developing Windows services using Delphi for many years now and something I have come across over the past few years is that some developers when updating a service think it is necessary to uninstall and reinstall the service rather than stopping the service, updating the exe and starting the service. 

Here are. the reasons why it's best not to reinstall:

Uninstalling and reinstalling a Windows Service for a simple update is considered bad practice because it strips away all service-level configuration and state managed by the Windows Service Control Manager (SCM).

Here are the primary reasons why stopping, replacing the executable, and restarting is the standard approach:

1. Loss of Service Configuration & Permissions

When you uninstall a service (e.g., using `sc delete` or `installutil /u`), Windows removes the entire registry key for that service under `HKLM\SYSTEM\CurrentControlSet\Services\`. This wipes out critical configuration settings:

* **Service Account & Credentials:** Custom Log On credentials (e.g., specific domain accounts or managed service accounts) revert to default or must be manually re-entered, requiring sensitive passwords during deployments.

* **Startup Type:** Settings like *Automatic (Delayed Start)* or *Manual* are lost.

* **Failure Actions & Recovery:** Custom auto-restart triggers, recovery actions, and reboot schedules on process crash are erased.

* **Dependencies:** Relationships showing which other services depend on this service (or which services it depends on) are broken.

* **Custom Security Descriptors (DACLs):** Custom permissions set on the service itself to dictate who can start, stop, or manage it are deleted.

2. Registry Fragility and "Marked for Deletion" Issues

When you command Windows to delete a service while any process (such as Event Viewer, Services MMC snap-in, or Task Manager) holds an open handle to that service’s registry key, Windows cannot complete the deletion immediately. Instead, it marks the service as **"Marked for Deletion."**

If your deployment script immediately attempts to reinstall the service under the same name:

* The installation will fail with `Error 1072 (ERROR_SERVICE_MARKED_FOR_DELETE)`.

* Resolving this often requires closing every handle or performing a full system reboot, turning an automated deployment into manual troubleshooting.

3. Disruption to Event Logs and System History

Uninstalling can orphan or disrupt Windows Event Viewer log subscriptions and diagnostic tracing associated with the service's registry entry, making post-deployment audit trails harder to trace continuously.

The Recommended Process

To update a service binary cleanly, follow this sequence:

1. **Stop the service:** `sc stop MyService` or `Stop-Service MyService`

2. **Wait for graceful shutdown:** Ensure the process terminates so file locks on the executable are released.

3. **Overwrite/Update the binaries:** Replace `MyService.exe` and associated DLLs in the installation folder.

4. **Start the service:** `sc start MyService` or `Start-Service MyService`


**When *is* an uninstall/reinstall appropriate?**

Only when structural metadata about the service itself changes—such as renaming the internal service name, altering low-level service architecture, or performing a major software release that completely changes the deployment path and configuration structure.


These are the comments from Gemini. I've also asked ChatGPT, Copilot and Grok and they all come back with similar reasons. 
I'm going to try to find out why these developers think it is best to uninstall/install every time an update is done.

No comments:

Post a Comment