Sams Teach Yourself MCSE Windows NT Server 4 in 14 Days
(Publisher: Macmillan Computer Publishing)
Author(s): David Schaer, et al
ISBN: 0672311283
Publication Date: 12/15/97

4.4.4. The Alerter Service

The Alerter service is used to generate administrative notifications. The Alerter service can generate alerts based on events, such as a disk nearing capacity, a printer running out of paper, or a shutdown request being issued to the server.

Server Manager or Performance Monitor is used to define which users or computers will receive the administrative alerts. Figure 4.16 shows the Server Manager configured to send the alerts to the user DAVIDS and the computer NTMASTER.

Figure 4.16.  Using Server Manager to configure where to deliver alerts.

The Alerter service generates the alert but depends on the Messenger service to perform the delivery.

4.5. Understanding Registry Entries

NT uses the settings in the registry to control how each of the individual services is configured. The registry lets NT know where the executable is located, initialization settings, dependencies, and error reporting levels.

Viewing the registry with REGEDIT.EXE instead of REGEDT32.EXE lets you search on values as well as on keys and subkeys.

The configuration settings for the Alerter service are provided in Figure 4.17 as an example.

Figure 4.17.  The Alerter service settings in the registry.

The Alerter service does not have an entry in the DependOnGroup setting. Services with an entry in DependOnGroup require that at least one of the services listed in the DependOnGroup setting start before the service starts.

The DependOnService entry shows that the LanmanWorkstation service must be started before the Alerter service is started.

The DisplayName entry value is set to Alerter. This is how the service name will appear when viewed through the applets.

The ErrorControl value is set to 0x1. If the Alerter service failed to start, an entry would be recorded in the event log, but the system would continue to initialize. Services with an ErrorControl value of 0x0 report no errors. Those with ErrorControl values of 0x2 or 0x3 will record the error and also attempt to reinitialize the system using the LastKnownGood configuration. A value of 0x2 will continue on error while a value of 0x3 will cause a bug check to be run.

The ImagePath entry tells NT where the actual executable is located. In the case of the Alerter it is one of many commands that are internal to SERVICES.EXE.

The StartValue of 0x2 shows that the Alerter is set to automatically start. Values lower than 0x2 are usually reserved for drivers; for example, the driver needed to access the boot partition would be assigned a value of 0x0 and be called by the NTLDR file during the boot phase. Those with a value of 0x1, such as the video driver, will be called during the initialization phase. Services with a StartValue of 0x3 require a manual start by the user or another process. Disabled services and drivers receive a StartValue of 0x4.

The TypeValue is set to 0x20. This means that the service will be capable of launching within the same Win32 process space as other services. A service like the Domain Name Server has a value of 0x10 and runs in its own process space. An advantage to having a service run in its own process space is that it can be tracked independently in Performance Monitor, as shown in Figure 4.18. Services internal to SERVICES.EXE are tracked collectively under services.

Figure 4.18.  Performance Monitor set up to track services.

4.5.1. The Messenger Service

The Messenger service is used to send and receive network messages. For example, the administrator might want to send a message to all users on the server before shutting it down. The administrator can send a message using the options in Server Manager, as shown in Figure 4.19.

Figure 4.19.  Server Manager can be used to generate a message.

The message that is delivered to the users by the Messenger service is shown in Figure 4.20. The computer on which a message is to be received must also be running the Messenger service.

Figure 4.20.  The message as it appears to the user.

4.6. Configuring Services

The Services applet under the Control Panel enables the administrator to control the startup of services. Figure 4.21 shows the status of services on NTMASTER.

Figure 4.21.  The status of services on NTMASTER.

Server Manager can also be used to configure services on remote computers.

4.6.1. Start Options

The system administrator can define which services will be initialized when NT boots. There are three service start options: automatic, manual, and disabled.

A service that is configured to start automatically will be launched when NT boots. The user does not need to log on to the computer to activate the service. The Server service is an example of a service that is configured to start automatically. Figure 4.22 shows the configuration of the startup parameters.

Figure 4.22.  The Server service is configured to start automatically.

The settings made through the Services applet are recorded in the registry, as shown in Figure 4.23. The start value set to 0x2 shows the service will be started automatically. A value of 0x3 represents manual, and 0x4 represents disabled.

Services that are set to start manually can be started by the user or by another service that calls it as a dependency. A disabled service cannot be started manually by the user or called by another service. An administrator can choose to disable a restricted service on an NT workstation to prevent the user from activating it manually.

Figure 4.23.  The registry holds the service initialization settings.

4.6.2. Configuring Service Accounts

Because NT supports discretionary access control, even the actions of services are governed by system security. By default, most services are configured to run with the security of the system account. The system account is not a configurable user account.