Service start types

Service monitoring in SCOM can be challenging at times, particularly if you have services with inconsistent names or display names. In that scenario it can be easier to discover and monitor services using a WMI wildcard like this mp does. That's all well and good when the services are all auto start, but what about services that are set to start automatically but are delayed or trigger start? As you can see from the table below, it may be normal for them to not be running.

Reading this article (which I still find confusing) the basic service monitor in SCOM only monitors services with an automatic start type by default. To try and improve this, Kevin wrote his own monitor type called Monitor.Service.WithAlert.FreqAndSamples.IgnoreDisabled.mpx which is in his Fragments repo. On inspection it is more advanced but there's no mention of services with delayed or trigger start type.

As of 28/4/2023 I still don't know if SCOM will alert when a service isn't running that is set to start automatically but has a delayed or trigger start type, so need to test this and update the article.

You can only get delayed or trigger start info from the registry under HKLM\SYSTEM\CurrentControlSet\Services. PowerShell, SC.exe and GWMI don't show it.

START_TYPE	REG_INFO	COMMENTS
Disabled	Start=4
Manual	Start=3
Automatic	Start=2	Good for monitoring.
Automatic (Delayed start)	Start=2 Will have DelayedAutostart=1	Can be in stopped state. Usually waits for other services to start.
Automatic (Trigger start)	Start=2	Can be in stopped state. Usually an event is sent to start it.

Start Type	Registry Info	State	Notes
BootStart	0	1	2