2

I'm reviewing the logs of a Windows Server 2008 R2 server which is running inside a VM. The server hosts an Azure web role. The logs contain this record:

The Plug and Play service entered the running state

This is completely unattended server hosted inside a VM.

Why would it need this service in the first place?

I say Reinstate Monica
  • 3,132
  • 7
  • 28
  • 52
sharptooth
  • 2,739
  • 4
  • 32
  • 40

2 Answers2

4

Among other things you need this service to enumerate both new and, at boot time, existing hardware.

According to this Wikipedia's article the Plug and Play Service implements the bulk of the work done by the Plug and Play Manager. The PnP Manager is responsible for hardware detection and resource management, including boot-time detection:

The Plug and Play (PnP) manager provides the support for PnP functionality in Windows and is responsible for the following PnP-related tasks:

  • Device detection and enumeration while the system is booting
  • Adding or removing devices while the system is running

Further, during system startup the PnP Manager loads the file system drivers and drivers marked SERVICE_BOOT_START as described in the MSDN article What Happens to File Systems During System Boot:

The PnP Manager calls the DriverEntry routines of the RAW file system and all SERVICE_BOOT_START drivers.

For these reasons and more it's appropriately stated in the service's description Stopping or disabling this service will result in system instability.

I say Reinstate Monica
  • 3,132
  • 7
  • 28
  • 52
3

For a start there are several services that depend upon the Plug and Play Service:

WWAN AutoConfig
Windows Biometric Service
Windows Driver Foundation - User-mode Driver Framework
Virtual Disk
Internet Connection Sharing (ICS)
Routing and Remote Access
Remote Access Auto Connection Manager
Remote Access Connection Manager
Fax
Telephony
Tablet PC Input Service
Smart Card
Windows Audio
Windows Audio Endpoint Builder

Perhaps one of these services needed to start?

The Plug and Play service is an integral part of windows 7 / 08, if you are really interested to know why it exists, what it does and what may cause it to stop and start, then you could do worse than to obtain and read Windows Internals by Mark Russinovich.

TL;DR - Since you don't know what this service does, or how it relates to the OS as a whole, it's probably best if you don't speculate about whether or not it should be running.

BlueCompute
  • 2,954
  • 2
  • 19
  • 28