How to disable Server Infrastructure Licensing Service

Symptoms:

Critical: Your Hyper-V licensed as Essentials R2 Server shuts down weekly. You observe the log "The process C:\Windows\system32\silsvc.exe [computername] has initiated the power off of computer [computername] on behalf of user NT AUTHORITY\SYSTEM" or similar, as described here.

Non-critical: You receive an error message "The SILSVC should be started automatically but it is stopped" as described here. If this is the case, you can either follow this link for a workaround, or read further below.

Issue:

In both cases above you are running an ex-Windows Essentials that was either upgraded to Standard or stripped down to its sole Hyper-V functionality. There is a service called Server Infrastructure Licensing Service (aka silsvc if you are using sc command) that is causing the trouble after you transmogrify the Essentials edition. By the way, this Transmog term was new for me 🙂

The problem is the service cannot be stopped, neither from the services.msc nor using sc stop silsvc.

First question that needs to be cleared reads: ‘how critical is the service?’ If you look at it, there are no dependencies. Also the TechNet blog above confirms that you are not going to break your server if the service is missing or disabled.

As described by the first symptom though, you would hardly be able to restart a Hyper-V on which the productive environment is running. So how can you stop the service?

The first reasoning was to use SC from the elevated prompt: sc config "silsvc" start= disabled

Unluckily although a successful exit code is returned if you run sc query silsvc you will still see that nothing has changed and the service is still running and not stoppable. SC stop silsvc is as useless as you can imagine.

The second reasoning is to go and change the settings directly into the registry that can be found under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\silsvc. You will be confronted with security restrictions:

And you cannot add your account with Full Access permissions:

Since taking ownership on registry keys is not very comfortable for me, I decided to try a third option.

Third playground: NTFS permissions and Task Manager.

If you try to kill the process directly from the Task Manager you will most probably think that this cannot act also. By looking closely however, you will see that each time you end a task, the process ID is being changed.

Exactly this is the Achilles’ heel of the service: if you succeed in deleting or renaming the silsvc.exe file there will be nothing to start again. The file itself is precautionally NTFS protected. You will have to take ownership of the file and then grant yourself sufficient permissions to move or rename the file (I never recommend deleting!).

After adjusting the NTFS permissions and changing the file’s name and/or location you can kill the process and subsequently change the start type of the service to disabled. All can be done online without stopping any productive function.

Enjoy!

47 comments

  1. I was having the issue of the server restarting and I tracked it down to be the silsv.exe.. However, after I renamed the silsv.exe and rebooted the server, the service is no longer started, but….. Windows is now no longer activated. In the control panel>System…. it shows “Windows Not Activated” under the Windows Activation heading. Any Ideas?

    1. Hi KingA. I am not aware of such issue but it is fully legitimate to activate it once again with the product key in your possession.

      1. I tried “re-Activating” my windows using my activation key. It would not take the key. I have went back and renamed the “silsv.exe” to its original name. When I rebooted the server, the service now runs and windows is activated. I will have to look into what Thorsten suggest above. Thanks for the comments.

  2. I think the cleaner solution is to deactivate the service (set start=4). This has to be done offline, i. e. from Windows Recovery Environment). Just shutdown the server, boot from the DVD/ISO, open regedit, load the system hive, and change start from 2 to 4 (under the service branch silsvc).

    Now the service is deactivated, and no system files are altered. Any windows audit method will pass.

  3. About windows deactivation, I have seen no such issue, I believe that if you have a valid license key you should definitely be able to activate but if you are having issues, and I do not recommend this as a way to get around paying for a license, but you have the ability to activate using windows loader for windows 7, license keys are available for sbs and that should solve the problem.

  4. Hey, I got the ownership of silsvc.exe as admin, but i cant change the permission, so i cant rename the file…. any ideas?

    1. Hi, since you can take ownership you should be able to change permissions as well. I’ve never seen such NTFS misbehavior. Try once again to get full rights for the owner and make sure that no process is blocking the file using handle from sysinternals.
      Otherwise use Thorsten’s approach to boot from WinR.
      Best.

  5. I was able to delete the file by taking ownership, im going to explain it as detailed as possible.

    1 Take ownership of the file (silsvc.exe), located in under the system32 folder (You have to enable view system files on your properties)
    2. Give yourself full permissions
    3. Delete the users (System, TrustedInstaller and everyone) from the security tab
    4. Kill the silsvc.exe process under the task manager
    5. Delete the file

    That’s it.

  6. Brilliant thanks, had demoted our sbs2011 but still used it on the network. Silvsvc was regularly shutting it down. Renamed the .exe and that has hopefully sorted it.

  7. thanks alot!

    SILsvc complained about “The Forest Trust Check in the Licensing component did not pass because error 0x8007054B occurred in function f1 [PHQG]. The specified domain either does not exist or could not be contacted.”, yet netraces showed that all domain servers were reachable by the member server. after debugging our AD and Windows 2012 R2 Foundation server for over 8hrs I gave up and disabled the service… for now.

    here’s a way to do it without having to modify permissions or booting into recovery: start an elevated command prompt and execute
    taskkill /IM silsvc.exe /F && sc config silsvc start=disabled

      1. it does if you run the command *right after* you kill the task… notice the “&&”

    2. Hi Thomas,

      thank you very much for this elegant solution!

      I can confirm that the proposed command concatenation with && works reliable. Just tested in a virtual machine with Windows Server 2012R2 Essentials. The silsvc service stays deactivated after a reboot.

      Here is the log (prove) from the shell:

      ————————————————–
      C:\Windows\system32>sc query silsvc

      SERVICE_NAME: silsvc
      TYPE : 10 WIN32_OWN_PROCESS
      STATE : 4 RUNNING
      (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
      WIN32_EXIT_CODE : 0 (0x0)
      SERVICE_EXIT_CODE : 0 (0x0)
      CHECKPOINT : 0x0
      WAIT_HINT : 0x0

      C:\Windows\system32>taskkill /IM silsvc.exe /F && sc config silsvc start=disabled

      ERFOLGREICH: Der Prozess “silsvc.exe” mit PID 2504 wurde beendet.
      [SC] ChangeServiceConfig ERFOLG

      C:\Windows\system32>sc query silsvc

      SERVICE_NAME: silsvc
      TYPE : 10 WIN32_OWN_PROCESS
      STATE : 1 STOPPED
      WIN32_EXIT_CODE : 1067 (0x42b)
      SERVICE_EXIT_CODE : 0 (0x0)
      CHECKPOINT : 0x0
      WAIT_HINT : 0x0

      —————————————–

      BTW short translation of the German output: “SUCCESS. “The process silsvc.exe was terminated”. Change ServiceConfig: SUCCESS

      So, it is not necessary anymore to open the registry offline for modifying the service start option.

  8. Heck, disabling licence servers – brings us back to the NT days.

    Did anyone mistakenly purchase 2012 Essentials thinking it would be a suitable member server?

    Foundations doesn’t let you install in a VM so that isn’t suitable, I know some people complain about too many license options, but I think there isn’t enough – or at least they leave an annoying gap in places you need stuff.

    Adding HyperV is new to me, this wasn’t originally the case which is obviously why the guest version is having an issue as it does not realize it can run “not as a DC”.

    1. Simon, I can sing a whole opera about it: do you think I implemented Essentials because tight is right? No, it was the alleged ‘simplicity’ for Small Businesses (in my customer’s case the password sync with O365 without configuring AD federation). Now I invested more time to twist and tweak. Oh, whatever.
      PS: my old IT guts tell me that Essentials will be deprecated instead of improved. That’s MS: abandoning genuine discoveries and ’embracing’ established third party solutions.
      Pooh!

  9. Just a follow on from a year ago, I can say that this successfully resolved the issue for me.
    Has there actually been any word from MS on this issue? Because it took me a good while to realize what was going on before finding your article.
    Much appreciated again.

  10. Microsoft is changing its products in extremely inconsistent and unprofessional ways, following hypes and their changing manager’s changing moods. In former versions there was at least something to rely on, now everything is chaos, they don’t even care about documenting and writing clear licensing guidelines, not only for Windows 10 but also for their server products. At the same time things become more complex through virtualization etc. Finding your small business server shut down without warning is a desaster but they just don’t care. Let’s see how long it will take until they lose all customers, they are working in the “right” direction…

Comments are closed.