Debugging a Windows NT Service (170738)

IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry

SUMMARY

Debugging a Windows NT service can be done in several ways. You can debug a service while it is running by attaching to the process ID of the Service through a debugger such as NTSD or WINDBG. You can also set Windows NT so that it will start the process in a debugger when you start the service.

These techniques are useful for different debug scenarios. This article discusses the steps that you need to take when you want to debug a service during the initialization.

MORE INFORMATION

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

In order to set up Windows NT so that it will start the Service in a debugger, the following registry key needs to be set during the Service initialization:

Start Registry Editor and locate the following Registry subkey in the HKEY_LOCAL_MACHINE subtree:

      SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
      Options

Create a subkey with the name of your Service executable (for example, Myservice.exe)
To this subkey, add the REG_SZ value called Debugger and the full path to the debugger you want to use, but omit the ".exe" extension. You can add any command-line option for the debugger as well.
Close Registry Editor.
Start the Service.

NOTE: The service must run as Local System and have "Interact with Desktop" enabled in order for the debugger to show up on the default desktop. For example:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yourapp.exe "Debugger"="C:\windbg -g"

The debugger will start when the image for the Service executable is loaded into memory.

For additional information about Windows NT debuggers, click the article number below to view the article in the Microsoft Knowledge Base:

121434 Specifying the Debugger for Unhandled User Mode Exceptions