It is advisable to perform a thorough review of the dependencies of the services or executables to be blocked. This is crucial because many Windows services are used by different applications to carry out essential tasks such as updates, recovery processes, synchronization of settings, and other functions. If these services are blocked through management policies, when an application or program tries to run and needs to access those blocked services, a message will be displayed. This type of message can lead to confusion in the user, as the underlying cause of the problem may not be apparent. In addition, blocking essential services could affect the performance of the applications that depend on them, which could result in crashes or erratic operation of those applications.
Therefore, it is important to carefully consider which services are blocked, making sure that you do not interfere with the fundamental processes that maintain the stability, security, and functionality of the system and applications.
It should be noted that when restricting software by applying policies in ADM, the agent immediately detects the activation of restricted software. At that point, the agent stops the associated service or process and executes the previously configured warning message. However, because the message only indicates that the software has been blocked without specifying which service or application was affected, further analysis is necessary to identify the cause of the crash.
To do this, the log file generated by the agent must be reviewed. By doing so, it will be possible to clearly identify the name of the specific application or service and PID that triggered the blocking message, facilitating the resolution of the problem.
As can be seen in the image above, the service was elevation_service.exe executed and subsequently stopped by the agent. Importantly, the lock message may appear more than once. In the example shown in the image, five instances of the elevation_service.exe service were detected. The ADM agent is configured to stop all processes associated with this service name, which explains why a blocking message has been generated for each of the detected instances.
This behavior occurs because the agent not only stops the first process encountered, but acts on all instances of the service that are currently running. Therefore, if a service like elevation_service.exe has multiple instances running, each of them will be blocked, resulting in the repeated occurrence of the warning messages.
List of essential services
Below is a list of essential services that should not be blocked:
- Windows Audio (Audiosrv)
Responsible for the management of sound services in the system. If it is blocked, users will not be able to listen to audio. - Windows Update (wuauserv)
It ensures that the operating system receives critical security updates and other important patches. Disabling this service could put the security of the system at risk. - Windows Defender Antivirus (WinDefend)
The Windows antivirus service protects the system against malware and other security threats. Blocking it would leave the system vulnerable. - Windows Event Log (EventLog)
It is critical for logging system events and generating audit logs. Disabling it would prevent troubleshooting and monitoring. - Task Scheduler (Schedule)
Allows scheduled execution of tasks on the system. Blocking this service can affect the operation of automatic tasks and scheduled updates. - DHCP Client (Dhcp)
This service is essential for dynamic IP address fetching on networks. Blocking it could disrupt network connectivity. - Network Location Awareness (NlaSvc)
It helps determine network configurations and maintain proper connectivity. Blocking it can cause problems with networking. - Windows Management Instrumentation (Winmgmt)
It is crucial for remote management and gathering system information. Blocking it could interfere with management and diagnostic tools. - Print Spooler (Spooler)
Responsible for managing print jobs. Disabling it would prevent printing on the machine. - Remote Procedure Call (RPC) (RpcSs)
A fundamental service for communication between different services and applications of the system. Its interruption could cause failures in multiple services and applications. - Cryptographic Services (CryptSvc)
Manage crypto-related operations, such as digital signatures and encryption keys. Blocking them could affect updates and overall security. - Windows Installer (MSIServer)
Required to install, maintain, and remove software. Blocking it would affect the ability to install or update apps. - ElevatorService (Elevator_Service)
This service is related to running applications with elevated privileges (administrative). It is important for certain tasks that require administrator permissions, such as installing programs. Disabling it might prevent some apps from running properly. - Windows Time (w32time)
Synchronizes system time with network time servers. This is important for system time accuracy, especially in network environments. - Server (LanmanServer)
It is crucial for sharing files and printers on a network. Disabling this service would disrupt the ability to share resources on a network.