Why would I need the “Plug and Play” service in a Windows Server hosted in a VM

windows-server-2008-r2windows-service

I'm reviewing the logs of a Windows Server 2008 R2 server which is running inside a VM. The server hosts an Azure web role. The logs contain this record:

The Plug and Play service entered the running state

This is completely unattended server hosted inside a VM.

Why would it need this service in the first place?

Best Answer

Among other things you need this service to enumerate both new and, at boot time, existing hardware.

According to this Wikipedia's article the Plug and Play Service implements the bulk of the work done by the Plug and Play Manager. The PnP Manager is responsible for hardware detection and resource management, including boot-time detection:

The Plug and Play (PnP) manager provides the support for PnP functionality in Windows and is responsible for the following PnP-related tasks:

Device detection and enumeration while the system is booting

Adding or removing devices while the system is running

Further, during system startup the PnP Manager loads the file system drivers and drivers marked SERVICE_BOOT_START as described in the MSDN article What Happens to File Systems During System Boot:

The PnP Manager calls the DriverEntry routines of the RAW file system and all SERVICE_BOOT_START drivers.

For these reasons and more it's appropriately stated in the service's description Stopping or disabling this service will result in system instability.

Examples

Dependency on one other service:

sc config ServiceA depend= ServiceB

Above means that ServiceA will not start until ServiceB has started. If you stop ServiceB, ServiceA will stop automatically.

Dependency on multiple other services:

sc config ServiceA depend= ServiceB/ServiceC/ServiceD/"Service Name With Spaces"

Above means that ServiceA will not start until ServiceB, ServiceC, and ServiceD have all started. If you stop any of ServiceB, ServiceC, or ServiceD, ServiceA will stop automatically.

To remove all dependencies:

sc config ServiceA depend= /

To list current dependencies:

sc qc ServiceA

Windows Application Experience Service

This service starts on a trigger. In order to see what the trigger that starts this service is, you can do:

C:\Users\Ryan>sc qtriggerinfo AeLookupSvc
[SC] QueryServiceConfig2 SUCCESS

SERVICE_NAME: AeLookupSvc

        START SERVICE
          CUSTOM         : 18f4a5fd-fd3b-40a5-8fc2-e5d261c5d02e [ETW PROVIDER UUID]

An Event Tracing for Windows event occurs and the service is triggered.

Let's look in the registry and see if we can find any more information on that UUID.

(Open images in new tab for full size.)

ETW1

Looks like you could disable the event provider here, if you wanted to.

In Event Viewer, make sure "Show Analytic and Debug Logs" is enabled in the View menu, and you can see the event logs:

LOGS

Some of these events have tasks attached to them, so that things happen when the events occur.

TASKS

The Application Experience infrastructure does a lot of stuff. But a lot of it is probably not very important for a server. It collects telemetry information about how you are using your computer, and ships that information off to Microsoft to help them figure out how you use your PC, if you've opted in to the Customer Experience Improvement program, or whatever they call it. They diagnose common crashes and develop new patches for Windows based on that telemetry information streaming back to them from all around the world.

The Application Experience service also applies compatibility shims to applications too. Users might not have as good of a... application experience... were that service to be disabled. (For instance, maybe Outlook 2007 would crash on Win 8.1 unless this service seamlessly applied a compatibility shim when the user launched Outlook, etc. There is a huge database of compatibility shims for thousands of permutations of applications and OS versions and CPU architectures and, ... and, and...) Microsoft might notice, based on their vast amount of collected telemetry data, that a million people are suffering from an application crash and they all have some specific things in common about how their PCs are configured, what versions they're running, etc., and Microsoft may develop an update or a new compatibility shim based on that info.

Lastly, you asked not only what is prompting it to start, but also why it stops? Well the answer is simply "it stops when it has no more work to do." It goes to sleep, only to be woken up again by one of those triggers. This is completely specific to the service and it's up to the developers who wrote the service as to what logic the service uses to decide when to stop. There is probably just some logic in the service that says "if I haven't done anything useful in 1 hour, then exit."