[windows-services] How to solve "The specified service has been marked for deletion" error

I try to remove a Windows Service with sc delete <service name>, and encounter the following error:

[SC] DeleteService FAILED 1072:

The specified service has been marked for deletion.

What I've already done:

• Stopped the service, obviously. The sc queryex "<service name>" gives the following result:

  SERVICE_NAME: Stub service
          TYPE               : 10  WIN32_OWN_PROCESS
          STATE              : 1  STOPPED
          WIN32_EXIT_CODE    : 1067  (0x42b)
          SERVICE_EXIT_CODE  : 0  (0x0)
          CHECKPOINT         : 0x0
          WAIT_HINT          : 0x0
          PID                : 0
          FLAGS              :
  

• Ensured that Microsoft Management Console is closed (taskkill /F /IM mmc.exe),

• Ensured that Event Viewer is closed,

• Removed the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<service name> from the registry.

  Due to this removal, services.msc still shows the service (with a name, but no status or startup type), but the description is “<Failed to Read Description. Error Code: 2 >”. When attempting to view the properties, “The system cannot find the file specified.” is shown five times.

The problem persists.

What is the next step?

Closing every window that was currently open followed by running the following command solved the issue for me:

taskkill /F /IM mmc.exe

I was having this issue when I was using Application Verifier to verify my win service. Even after I closed App Ver my service was blocked from deletion. Only removing the service from App Ver resolved the issue and service was deleted right away. Looks like some process still using your service after you tried to delete one.

It seems that on Windows versions later than Windows 7 (unverified, but by experience latest with Windows Server 2012 R2), the Service Control Manager (SCM) is more strict.

While on Windows 7 it just spawns another process, it is now checking whether the service process is still around and may return ERROR_SERVICE_MARKED_FOR_DELETE (1072) for any subsequent call to CreateService/DeleteService even if the service appears to be stopped.

I am talking Windows API code here, but I want to clearly outline what's happening, so this sequence may lead to mentioned error:

SC_HANDLE hScm = OpenSCManager(nullptr, nullptr, SC_MANAGER_ALL_ACCESS);

SC_HANDLE hSvc = OpenService(hScm, L"Stub service", SERVICE_STOP | SERVICE_QUERY_STATUS | DELETE);

SERVICE_STATUS ss;
ControlService(hSvc, SERVICE_CONTROL_STOP, &ss);
// ... wait for service to report its SERVICE_STOPPED state

DeleteService(hSvc);
CloseServiceHandle(hSvc);
hSvc = nullptr;

// any further calls to CreateService/DeleteService will fail
// if service process is still around

The reason a service process is still around after it already has reported its SERVICE_STOPPED state isn't surprising. It's a regular process, whose main thread is 'stuck' in its call to the StartServiceCtrlDispatcher API, so it first reacts to a stop control action, but then has to execute its remaining code sequence.

It's kind of unfortunate the SCM/OS isn't handling this properly for us. A programmatic solution is kinda simple and accurate: obtain the service executable's process handle before stopping the service, then wait for this handle to become signaled.

If approaching the issue from a system administration perspective the solution is also to wait for the service process to disappear completely.

Most probably deleting service fails because

protected override void OnStop()

throw error when stopping a service. wrapping things inside a try catch will prevent mark for deletion error

protected override void OnStop()
{
            try
            {
                //things to do
            }
            catch (Exception)
            {
            }

}

Deleting registry keys as suggested above got my service stuck in the stopping state. The following procedure worked for me:

open task manager > select services tab > select the service > right click and select "go to process" > right click on the process and select End process

Service should be gone after that

This can also be caused by leaving the Services console open. Windows won't actually delete the service until it is closed.

The main reason for the error is the process is not stopped. to resolve it start task manager go to services and see if you are still able to see your service than go to the process of that service and end process. Than the issue will be solved completely.

Sometimes this could happen during service deletion via PowerShell remote session script, especially when you are trying to delete service several times. In this case, try to recreate a session before the deletion:

Remove-PSSession -Session $session
$newSession = New-PSSession -ComputerName $Name  -Credential $creds -ErrorAction Stop
Enter-PSSession $newSession

This works for me.

• Open Task Manager
• Select services tab
• Select the service with the issue
• Right click and select "Go to details"
• Right click on the service and select "End process tree"

End process tree will end the process and all the processes created by the process.

Then, you can reinstall the service.

I had the same problem, finally I decide to kill service process.

for it try below steps:

• get process id of service with

  sc queryex <service name>

• kill process with

  taskkill /F /PID <Service PID>

If the steps provided by @MainMa didn't work follow following steps

Step 1 Try killing the process from windows task manager or using taskkill /F /PID . You can find pid of the process by command 'sc queryex '. Try next step if you still can't uninstall.

Step 2 If above

Run Autoruns for Windows Search for service by name and delete results.

Closing the services console as suggested by a few of the answers here did allow me to remove the service. In my scenario this was only a short term fix since all subsequent reinstalls and removal of the service would require me to take these additional steps. Reviewing my web.config file, it was discovered that there was an error that once fixed, allowed me to easily remove the service without the additional closing of the services console step.

In my case, it was caused by unhandled exception while creating eventLog source. Use try catch to pin point the cause.

steps to follow:

step-1 goto the location C:\Windows\Microsoft.NET\Framework\v4.0.30319

step-2 run command: installutil /u full-path/servicename.exe

step-3 close services panel and reopen it

step-4 run command: installutil full-path/servicename.exe

This is what worked for me: - I hit the same issue: my service was stuck in 'marked for deletion'. - I opened services.msc My service did show up as running, although it was already uninstalled. - I clicked Stop Received an error message, saying the service is not in a state to receive control messages. Nevertheless, the service was stopped. - Closed services.msc. - Reopened services.msc. - The service was gone (no longer showing in the list of services).

(The environment was Windows 7.)

That means the service is still listed as disabled in services.msc. Just close the services.msc and re open as administrator... The service will not be listed. Now, install the service using the command,

installutil "path of service"

Discovered one more thing to check - look in Task manager - if other users are connected to this box, even if they are 'disconnected' you have to actually sign them out to get the service to finally delete.

In my case, I execute taskkill /f /im dongleserver.exe , where dongleserver.exe is my program's exe file.

Then I can able to reinstall my program already.

In my case it worked after closing the Services. Check if the Services.msc is open, if yes close it and check any process of service is found in Task Manager.

In my case, the service name was 'Monitor' which is also used by a windows service called 'Monitor', when I tried to update my services, I tried uninstalling them, the installer tried to remove the windows service 'Monitor' which it couldn't, and the installation was always rolled back.

I ended up renaming my service to something else