How to solve "The specified service has been marked for deletion" error

Question

I try to remove a Windows Service with sc delete <service name>, and encounter the following error:

[SC] DeleteService FAILED 1072:

The specified service has been marked for deletion.

What I've already done:

Stopped the service, obviously. The sc queryex "<service name>" gives the following result:

SERVICE_NAME: Stub service
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 1067  (0x42b)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
        PID                : 0
        FLAGS              :

Ensured that Microsoft Management Console is closed (taskkill /F /IM mmc.exe),
Ensured that Event Viewer is closed,
Removed the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<service name> from the registry.

Due to this removal, services.msc still shows the service (with a name, but no status or startup type), but the description is “<Failed to Read Description. Error Code: 2 >”. When attempting to view the properties, “The system cannot find the file specified.” is shown five times.

The problem persists.

What is the next step?

I know. But I thought about a less radical solution. Rebooting thirty times per day won't be an acceptable solution in my case. — Arseni Mourzenko, Dec 13 '13 at 09:32
Yet hacking around in the registry 30 times per day is acceptable? And why are you deleting services this regularly? — Damien_The_Unbeliever, Dec 13 '13 at 09:47
*"why are you deleting services this regularly?"*: I'm writing a Windows service. Each time it is compiled, it should be restarted. *"Yet hacking around in the registry 30 times per day is acceptable?"*: totally. Removing a key from registry doesn't force me to save everything, close every opened app, wait for a minute, and then reopen everything. — Arseni Mourzenko, Dec 13 '13 at 09:59
I've written windows services. Unless you're changing the actual code that performs the registration, there's no need to uninstall and reinstall it every time you do a build. So long as the path is still the same, the older registration information will still be valid. — Damien_The_Unbeliever, Dec 13 '13 at 10:05
Actually that's not a true Statement. @Damien_The_Unbeliever Microsoft has a build bug that has existed forever. You can't rebuild and deploy if it's x64. You have to edit the msi, so therefore you need to hack the registry if the state becomes corrupt. If MS had an actual reliable MSI install this wouldn't be an issue — Nick Turner, Feb 08 '18 at 16:53
@NickTurner - link to any bug report? Whatever bug you're referring to, I've not encountered. And I'm not sure how an MSI is involved since we're presumably talking about building and running services on a dev machine (that at least appears to be the context on this 5 year old question) — Damien_The_Unbeliever, Feb 08 '18 at 17:47

score 1375 · Accepted Answer · edited Oct 10 '18 at 08:15

1375

There may be several causes which lead to the service being stuck in “marked for deletion”.

SysInternals' Process Explorer is opened. Closing it should lead to automatic removal of the service.
Task Manager is opened.
Microsoft Management Console (MMC) is opened. To ensure all instances are closed, run taskkill /F /IM mmc.exe.
Services console is opened. This is the same as the previous point, since Services console is hosted by MMC.
Event Viewer is opened. Again, this is the same as the third point.
The key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{service name} exists.
Someone else is logged into the server and has one of the previously mentioned applications opened.
An instance of Visual Studio used to debug the service is open.

edited Oct 10 '18 at 08:15

Dan Atkinson

10,801
12
78
106

answered Dec 13 '13 at 11:23

Arseni Mourzenko

45,791
28
101
185

12

Task manager seems to do the same. And as noted below leaving the Services console open could cause this too. – CodingBarfield Feb 07 '14 at 08:31
4

...and if closing all these still does not help and you still see the service as "marked for deletion" do simple log off instead of full restart. it helped me a few times. – Nedko Jun 02 '14 at 16:17
2

One common workflow: your nefarious colleagues are also logged into the remote server, and they all have something open... – Chris O Jul 24 '14 at 17:50
In addition to MainMa's steps, I had to run `taskkill /F /PID pid` from an administrative cmd prompt. – miah Sep 09 '14 at 16:11
78

Closing the services console solved this problem for me! My process was the following: *In the VS2012 x64 Native Tools Command Prompt* **-->** *Navigate to directory with service exectuable* **-->** *installutil /u servicename.exe (to uninstall the obsolete service)* **-->** *copy over new built service exe* **-->** *installutil servicename.exe (to install the updated service)*. I generally can uninstall and reinstall right away with no problems. Until I randomly can't. Closing the services console solved it. Thanks for the tip! – thehelix Nov 11 '14 at 20:18
Faced the problem w/ elasticsearch 1.5.1. Only reboot helps. Looks like it happens only occasionally, sometimes I'm able to delete the service. – vorou Apr 12 '15 at 16:35
18

Process Explorer is the big one here, in my opinion. I suggest bolding it and/or moving it to the top of the list. – Coxy Sep 17 '15 at 09:12
3

In addition to that, I had to run `sc stop "Task Name"` and wait for the error message, until the `sc delete` worked. – L C Apr 25 '16 at 14:50
Log off and log on again resolved this issue for me. – BenCes May 09 '16 at 10:34
I had a config file for my service open in Notepad, under another user's session. Signed out, logged in under that user, closed Notepad, and my previous uninstallation I did through Program and Features (Add/Remove Programs) finally finished. – vapcguy Sep 19 '17 at 14:57
Very helpful, especially for a server environment where rebooting the machine is not an option. – Samuel Oct 17 '17 at 12:01
I just Ended the Service name task and it's fine. Looks like it had file permissions when deleting the temp files for cleanup. – Nick Turner Feb 08 '18 at 16:57
@Arseni Mourzenko, on point 7 "Someone else is logged into the server and has one of the previously mentioned applications opened." I doubt it. What about someone else already logged out, but opened them before logout? – Pingpong Apr 24 '18 at 14:08
@Pingpong: if the user logs out, all the applications he opened during his session are closed. – Arseni Mourzenko Apr 24 '18 at 20:11
1

confirming @LC answer. closing services window didn't work but "stop-service" on the supposedly deleted service did. – timB33 Aug 13 '18 at 10:41
For me having the Service Console open what the issue. Closed that and the issue went away. – Red_Phoenix Mar 13 '19 at 13:33
Why the hell would having the services console open cause this error to delete then install the service in powershell.... Well it seemed to work for me! – Andez Jan 22 '21 at 08:27

score 256 · Answer 2 · answered Jan 23 '14 at 13:51

256

This can also be caused by leaving the Services console open. Windows won't actually delete the service until it is closed.

answered Jan 23 '14 at 13:51

forcedfx

2,698
1
10
8

3

As I indicated in my question, “Microsoft Management Console is closed” during the tests. – Arseni Mourzenko Jan 23 '14 at 14:12
29

In my case the Services console was the problem. As soon as I closed it and reopened it the deleted services went away. – Farrukh Najmi Apr 24 '14 at 21:34
3

Hard to believe that keeping the window open was the case... Thank you! – Karol Tyl Oct 19 '17 at 23:23
This worked for me too, although strangely there's been plenty of cases where simply pressing F5 will refresh the list with the service removed. – Steve Smith Apr 11 '18 at 11:10
1

You saved my day – Pranoy Sarkar Nov 08 '18 at 06:52
Cookie for you, 5 years ago guy. Thanks! – AndyMcKenna Oct 16 '19 at 19:27
After doing this, right button on the service and close all tasks solved the problem for me. – Renan Araújo Nov 18 '19 at 14:04

score 57 · Answer 3 · edited Nov 17 '19 at 13:04

57

I had the same problem, finally I decide to kill service process.

for it try below steps:

get process id of service with

sc queryex <service name>
kill process with

taskkill /F /PID <Service PID>

edited Nov 17 '19 at 13:04

Cœur

32,421
21
173
232

answered Feb 10 '16 at 05:08

Ali Sadri

1,287
9
14

6

my PID is 0 so I had better not kill that! – rob Jun 10 '16 at 15:50
you can uninstall service for it do below steps 1- run cmd 2- change direction to .exe file of your service locate that 3- execute command installutil /u – Ali Sadri Jun 16 '16 at 06:45
+1 for sc queryex I'll be able to use that to get the PID if I want to attach the debugger – Paul McCarthy Jun 13 '17 at 09:58
Using an administrator mode command prompt is recommended. – Param Siddharth Jan 21 '21 at 10:31

score 54 · Answer 4 · edited Nov 03 '15 at 07:54

54

In my case it worked after closing the Services. Check if the Services.msc is open, if yes close it and check any process of service is found in Task Manager.

edited Nov 03 '15 at 07:54

Irshad

2,860
5
25
45

answered Nov 03 '15 at 06:38

Sumit Agrawal

683
6
3

IT WORKED for me !! The service process still lingered on in the task manager, I first closed the services console, then deleted the service process from Task manager. Then reopened services console to see the service gone! – sanrns Jan 04 '21 at 11:20

score 15 · Answer 5 · answered Mar 23 '18 at 09:10

15

That means the service is still listed as disabled in services.msc. Just close the services.msc and re open as administrator... The service will not be listed. Now, install the service using the command,

installutil "path of service"

answered Mar 23 '18 at 09:10

Amey P Naik

612
7
16

easiest solution ever :) – Dennis Don Oct 14 '20 at 15:00
I just had to reopen my services.msc and it's gone. thanks! – FritsJ May 11 '21 at 06:19

score 11 · Answer 6 · edited Oct 12 '15 at 18:48

11

Deleting registry keys as suggested above got my service stuck in the stopping state. The following procedure worked for me:

open task manager > select services tab > select the service > right click and select "go to process" > right click on the process and select End process

Service should be gone after that

edited Oct 12 '15 at 18:48

Rick Smith

8,219
13
75
81

answered Oct 12 '15 at 18:22

mathart63

111
1
2

score 9 · Answer 7 · answered Feb 20 '15 at 15:42

9

Discovered one more thing to check - look in Task manager - if other users are connected to this box, even if they are 'disconnected' you have to actually sign them out to get the service to finally delete.

answered Feb 20 '15 at 15:42

Kathy Gryta

109
1
1

4

Unnecessary. You just have to ensure everybody exits the Microsoft Management Console (MMC) and Services control panel. – user207421 Jul 08 '15 at 04:05

score 9 · Answer 8 · answered Feb 09 '20 at 15:53

Closing the services console as suggested by a few of the answers here did allow me to remove the service. In my scenario this was only a short term fix since all subsequent reinstalls and removal of the service would require me to take these additional steps. Reviewing my web.config file, it was discovered that there was an error that once fixed, allowed me to easily remove the service without the additional closing of the services console step.

score 6 · Answer 9 · answered Feb 02 '17 at 15:03

It seems that on Windows versions later than Windows 7 (unverified, but by experience latest with Windows Server 2012 R2), the Service Control Manager (SCM) is more strict.

While on Windows 7 it just spawns another process, it is now checking whether the service process is still around and may return ERROR_SERVICE_MARKED_FOR_DELETE (1072) for any subsequent call to CreateService/DeleteService even if the service appears to be stopped.

I am talking Windows API code here, but I want to clearly outline what's happening, so this sequence may lead to mentioned error:

SC_HANDLE hScm = OpenSCManager(nullptr, nullptr, SC_MANAGER_ALL_ACCESS);

SC_HANDLE hSvc = OpenService(hScm, L"Stub service", SERVICE_STOP | SERVICE_QUERY_STATUS | DELETE);

SERVICE_STATUS ss;
ControlService(hSvc, SERVICE_CONTROL_STOP, &ss);
// ... wait for service to report its SERVICE_STOPPED state

DeleteService(hSvc);
CloseServiceHandle(hSvc);
hSvc = nullptr;

// any further calls to CreateService/DeleteService will fail
// if service process is still around

The reason a service process is still around after it already has reported its SERVICE_STOPPED state isn't surprising. It's a regular process, whose main thread is 'stuck' in its call to the StartServiceCtrlDispatcher API, so it first reacts to a stop control action, but then has to execute its remaining code sequence.

It's kind of unfortunate the SCM/OS isn't handling this properly for us. A programmatic solution is kinda simple and accurate: obtain the service executable's process handle before stopping the service, then wait for this handle to become signaled.

If approaching the issue from a system administration perspective the solution is also to wait for the service process to disappear completely.

score 6 · Answer 10 · answered May 09 '17 at 10:55

This is what worked for me: - I hit the same issue: my service was stuck in 'marked for deletion'. - I opened services.msc My service did show up as running, although it was already uninstalled. - I clicked Stop Received an error message, saying the service is not in a state to receive control messages. Nevertheless, the service was stopped. - Closed services.msc. - Reopened services.msc. - The service was gone (no longer showing in the list of services).

(The environment was Windows 7.)

Windows 2008 here, I had to just close the services panel – Mathijs Segers Jul 05 '17 at 12:54 — Mathijs Segers, Jul 05 '17 at 12:54

score 5 · Answer 11 · edited Jul 11 '17 at 06:25

5

In my case, I execute taskkill /f /im dongleserver.exe , where dongleserver.exe is my program's exe file.

Then I can able to reinstall my program already.

edited Jul 11 '17 at 06:25

Suncatcher

8,420
8
42
78

answered Jan 17 '17 at 04:19

Sian Chiew See

61
1
4

score 5 · Answer 12 · answered Jan 30 '17 at 09:41

5

Closing every window that was currently open followed by running the following command solved the issue for me:

taskkill /F /IM mmc.exe

answered Jan 30 '17 at 09:41

Tshilidzi Mudau

5,472
6
32
44

score 4 · Answer 13 · answered Mar 20 '14 at 14:01

4

In my case, it was caused by unhandled exception while creating eventLog source. Use try catch to pin point the cause.

answered Mar 20 '14 at 14:01

Arijus Gilbrantas

199
2
2

score 2 · Answer 14 · answered Dec 06 '19 at 10:30

This works for me.

Open Task Manager
Select services tab
Select the service with the issue
Right click and select "Go to details"
Right click on the service and select "End process tree"

End process tree will end the process and all the processes created by the process.

Then, you can reinstall the service.

score 1 · Answer 15 · answered Apr 14 '20 at 05:22

In my case, the service name was 'Monitor' which is also used by a windows service called 'Monitor', when I tried to update my services, I tried uninstalling them, the installer tried to remove the windows service 'Monitor' which it couldn't, and the installation was always rolled back.

I ended up renaming my service to something else

Charith · Answer 16 · 2016-09-19T07:21:58.973

0

If the steps provided by @MainMa didn't work follow following steps

Step 1 Try killing the process from windows task manager or using taskkill /F /PID . You can find pid of the process by command 'sc queryex '. Try next step if you still can't uninstall.

Step 2 If above

Run Autoruns for Windows Search for service by name and delete results.

edited Sep 19 '16 at 07:21

answered Sep 19 '16 at 07:15

Charith

2,640
2
19
24

score 0 · Answer 17 · edited Feb 16 '17 at 13:44

0

The main reason for the error is the process is not stopped. to resolve it start task manager go to services and see if you are still able to see your service than go to the process of that service and end process. Than the issue will be solved completely.

edited Feb 16 '17 at 13:44

Donald Duck

6,488
18
59
79

answered Feb 16 '17 at 13:23

Gaurav Tyagi

788
5
9

score 0 · Answer 18 · answered Apr 19 '17 at 00:27

I was having this issue when I was using Application Verifier to verify my win service. Even after I closed App Ver my service was blocked from deletion. Only removing the service from App Ver resolved the issue and service was deleted right away. Looks like some process still using your service after you tried to delete one.

score 0 · Answer 19 · answered Nov 24 '17 at 05:00

0

steps to follow:

step-1 goto the location C:\Windows\Microsoft.NET\Framework\v4.0.30319

step-2 run command: installutil /u full-path/servicename.exe

step-3 close services panel and reopen it

step-4 run command: installutil full-path/servicename.exe

answered Nov 24 '17 at 05:00

Divyang Shah

1,326
10
21

1

a side note: installutil works ONLY as admin, so open a shell as admin. – ingconti Feb 06 '18 at 12:58

score 0 · Answer 20 · answered Oct 12 '18 at 13:40

Most probably deleting service fails because

protected override void OnStop()

throw error when stopping a service. wrapping things inside a try catch will prevent mark for deletion error

protected override void OnStop()
{
            try
            {
                //things to do
            }
            catch (Exception)
            {
            }

}

score 0 · Answer 21 · answered Dec 13 '19 at 15:48

Sometimes this could happen during service deletion via PowerShell remote session script, especially when you are trying to delete service several times. In this case, try to recreate a session before the deletion:

Remove-PSSession -Session $session
$newSession = New-PSSession -ComputerName $Name  -Credential $creds -ErrorAction Stop
Enter-PSSession $newSession

How to solve "The specified service has been marked for deletion" error

21 Answers21

Linked