Service not working (again). UAC box popping up

[harryray2]

Run as service is ticked, he service on my computer appears to be running. service is running in task manager but I'm getting a UAC box pop up.

I've reverted back to 1391 and the problem goes away. I haven't changed any of my settings.

I'm using portable everything on Win 7.

This happened before when I changed from 1384 to 1391, which, for some reason, corrected itself after a couple of weeks.

[therube]

Post, Help | Troubleshooting Information.


> I'm using portable everything on Win 7.

Ditto.

In my case, I uninstall/reinstall the Service (for better or worse) on a version update.

(From within directory where Everything.exe is...)
Everything.exe -uninstall-service
(Copy newer version over top existing)
followed by
Everything.exe -install-service
(Run Everything.exe)


In my case, Service is & has always been enabled in, Tools | Options | General.


Check your shortcut that you use to run Everything.
Any switches that might be affecting things?
Is the shortcut pointing to the correct Everything & location?

[harryray2]

Thanks...the Everything setting are exactly the same as before, and the service is running.

As I mentioned. this happened once before when I upgraded to 1391 and I had the same problem, but for some reason it corrected itself.

When I revert back to 1391, Everything works fine.

[void]

Everything 1.5.0.1393a fixes an issue with Everything reporting the service as partially installed. (when it was fully installed)

[harryray2]

I installed 1393 (portable).. the service appears to be running OK, but there is still the same problem.

[void]

In the UAC Prompt, click Show Details.

Take note the of the Program location.

What are the parameters being passed to the program location?

[harryray2]

I'm running Win7, the UAC box doesn't have a 'show details' box.

I've just noticed that the service running is the service for another instance of Everything I have installed. I have three Everything's in total installed but for some reason it's only starting a service for one of the other instances, rather than running the service for all the instances.

I think the service that's installed is for my original Everything, and the problem I'm having is for my second instance (the one I use daily).

[void]

Only one service needs to be installed.

If you have multiple Everything.exe files, please make sure they are all using 1393a.
-or-
Please make sure the Everything Service is using 1393a.
-check the Everything Service Everything.exe path under Start -> Services -> Everything -> Properties -> Path to executable.

[harryray2]

Only one service is installed, and all the instance work with 1391 but not 1393. Nothing has been changed on Everything or the system.
When you say, Start -> Services -> Everything -> Properties -> Path to executable,,do you mean go to services.msc on the system?

I had a look at the services.msc and it shows that it is pointing to one of the other instances, but it has always been the same, and besides that, I'm having the same problem with all the instances when upgrading to 1393

[tuska]

2harryray2
Please take a look at the picture...
 

2025-05-27_Everything Service_Path to EXE file_and_Task Manager-Services.png (411.98 KiB) Viewed 12220 times

 
____________________________________________________________
Windows 11 Pro (x64) Version 24H2 (OS build 26100.4061) - 2025-05-13
'Everything' 1.5.0.1393a (x64) - "Portable on system drive C:"

[tuska]

I am currently using the Everything Service as follows to avoid any problems:

BEFORE switching to one of the following versions
- I first REMOVE the Everything Service from the currently used Everything version (with Everything Service) and
- REINSTALL the Everything Service in the currently started Everything version (only for x64 and x86 - not as administrator)

---------------------------------------------
Everything 1.4  x64
---------------------------------------------
Everything 1.5a x64
Everything 1.5a x86
Everything 1.5a x64  as Administrator
Everything 1.5a x86  as Administrator
---------------------------------------------
Everything 1.5a x64  (file “NO_ALPHA_INSTANCE”)
Everything 1.5a x86  (file “NO_ALPHA_INSTANCE”)
Everything 1.5a x64  (file “NO_ALPHA_INSTANCE”) as Administrator
Everything 1.5a x86  (file “NO_ALPHA_INSTANCE”) as Administrator
----------------------------------------------------------------------------------

Everything instances
For each of the above Everything 1.5a, 1.5 x64, and x86 versions, additional Everything instances can be opened
using the same Everything Service name (from Everything-1.5.0.1280a - 14.10.2021).

I suspect that starting with Everything 1.5 Beta, there will only be ONE Everything Service called “Everything”
which will apply to all instances (including x64 and x86).

[NotNull]

I seem to remeber that the Everything Service only accepts requests from applications that are signed with the same certificate (security measure).
The certficate changed with version 1392.
Might be wrong though.

Worth checking what version of Everything64.exe is being used for the service(s).


In general, Everything 1.5 can have 2 services:
- An Everything service for the unnamed instance (in case of alpha instance = 0)
- An Everything (1.5a) service for all named instances.

[harryray2]

Thanks, if the certificate has changed, how do I go about correcting that, or is it a case of it can't be done with Win 7?

As I mentioned, this happened before when I upgraded from 1384 to 1391 but the problem disappeared after a couple of weeks. Could this also have been the result of an incorrect certificate?

[void]

Thanks, if the certificate has changed, how do I go about correcting that, or is it a case of it can't be done with Win 7?

There's nothing you need to change.

As I mentioned, this happened before when I upgraded from 1384 to 1391

Nothing has changed to the service between these versions.
So it's a little weird you're getting a UAC prompt when the service is installed correctly.

It's not clear to me what is even requesting the UAC prompt.

UAC prompt on Windows 7 should look like:

image.png (39.54 KiB) Viewed 12180 times

(Show details at the bottom left)

I seem to remeber that the Everything Service only accepts requests from applications that are signed with the same certificate

Older versions only allowed the same exe to connect.
You had to have a service installed for each exe.
This was removed to allow for multiple exe versions to connect so only one service was required.



Maybe the task manager will help show the current state of Everything.
In the Task Manager, click the Details view.
Show the Command line and User Name columns.
What is shown for all your Everything.exe processes?
Please upload a screenshot in a bug report.



When is the UAC prompt shown?
eg: When you click a shortcut to Everything or on startup.

[therube]

Ah, the 'ol hidden details "button" trick.
Never even considered that before.
.

Everything - Service UAC Prompt.png (31.33 KiB) Viewed 12100 times

(Oh, & yes, I'm aware that the -instance 15 [for Service install/uninstall purposes] is for not, but I've done it for so long now, so I'll continue [that tradition] .
And yes, I name mine "15" rather then "1.5" or "1.5a".)

[void]

Are you opening Everything from the taskbar?
-If so, please try right clicking the Taskbar button, right click Everything and click Properties.
In the Target, remove any parameters passed to Everything.
It should look like:

"C:\Program Files\Everything 1.5a\Everything64.exe"

[void]

Everything 1.5.0.1394a will no longer allow untrusted connections to the Everything Service.

Only executables signed by voidtools can connect to the Everything Service.

[therube]

I'll often take an Instance, copy it wholesale (for some reason or another), rename the instance name & fire it up (from a "go.bat" file).

(The other day) in doing things, throwing things around, not particularly paying attention, I got that message:

Code: Select all

Everything, requires administrative priviledges to index NTFS systems.
            Install the Everything service or run as administrator to index NTFS volumes.

	    Choose an option:
	    - Install service, Run index as admin, Run as admin, Manual config

Code: Select all

Everything 1.5.0.1396a (x86)
OS:	Windows NT 6.1 7601 (x64)
Admin:	0
Service:	2 (disconnected / installed and not running)
Command line:	-instance DUP.ON.K
Binary:	C:\DEV\Locate\15 - DUPS on K that can be DEL\Everything.exe
Profile:	C:\DEV\Locate\15 - DUPS on K that can be DEL\Everything-DUP.ON.K.ini
Database:	C:\DEV\Locate\15 - DUPS on K that can be DEL\Everything-DUP.ON.K.db
Instance:	DUP.ON.K

NOTE: Service: 2 (disconnected / installed and not running)

From what I recall, this did not happen on initial start up, but the dialog popped up some time thereafter.
Odd.

This very likely could have been my third, fourth, or fifth (simultaneous) Instance running.
No other Instances affected. Pretty sure I saw this at least two times (having Quit, then restarted that Instance again).

But then, & thereafter, as I was trying to figure out what was going on, I was then unable to duplicate the issue.
Everytime (thereafter), I get a Service: 6 (which is fine).

...

twas existing '15 - MULE' instance, circa 02-2025, Everything 1367
so all existing .db .ini .csv... that i simply copied, outright, to a new directory,
renamed [using Everything , EGOR.bat] the MULE (file names) to DUPS.ON.K
changed the .bat to run '-instance DUPS.ON.K' (same sort of thing i do, regularly)

& with that, at some point in time, NOT on initial startup, i get this "SERVICE"
prompt ?

so... really nothing MATERIAL between DUP.on.K .ini (existing) & .ini (fresh)
so... WHY did existing NOT attach to the "service", where new does ?
even ntfs_volume /seems/ inconsequential EXCEPT for _includes,
where existing had (pre)existing "offline" volumes (that were not removed) [like from old "dead" drives]

might it be a "TIMEOUT" that is (now) increased, by default, where before it was lessor, & that "lessor"
was "hitting" when accesssing, say a SLOW drive, so Everything thinking something "wrong" happened, where
it simply wasn't waiting, long enough (& where now, by default, it waits... longer ?)


(at some point I [Quit &] replaced the 1367 .exe with the current 1396 .exe.
don't recall if it was one or the other, or both [.exe] where the Service prompt prompted?)

...

[void]

This dialog is shown when Everything attempts to index an NTFS volume and it returns error 5 (access denied)

The service state of 2 (disconnected / installed and not running) is odd as Everything will automatically start the service if it is not running.

Could have been a communication issue between the newer builds an the old .exe.

1394+ will now reject connections from older versions (1391 or older).

See if there's any Everything Service crash reports under Start -> eventvwr -> Event Viewer -> Windows Logs -> System

[therube]

Code: Select all

TimeCreated SystemTime="2025-08-02T00:07:50.000000000Z"
The description for Event ID 0 from source Everything Service cannot be found.
Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

The following information was included with the event:   failed to process command 25 8


TimeCreated SystemTime="2025-08-02T00:07:50.000000000Z" 
The description for Event ID 0 from source Everything Service cannot be found.
Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

The following information was included with the event:   write 232

Seems 232 & 25 8 happens in pairs.
As I see the same happened back on 5-26-2025.

Code: Select all

==================================================
Event Time        : 08/01/2025 08:07:50.000 PM
Record ID         : 34796
Event ID          : 0
Level             : Error
Channel           : Application
Provider          : Everything Service
Description       : 
Opcode            : 
Task              : 
Keywords          : 0x0080000000000000
Process ID        : 
Thread ID         : 
Computer          : RUBEN7
User              : 
Log File          : 
==================================================



==================================================
Event Time        : 08/01/2025 08:07:50.000 PM
Record ID         : 34797
Event ID          : 0
Level             : Error
Channel           : Application
Provider          : Everything Service
Description       : 
Opcode            : 
Task              : 
Keywords          : 0x0080000000000000
Process ID        : 
Thread ID         : 
Computer          : RUBEN7
User              : 
Log File          : 
==================================================

[void]

These logs are normal for the alpha build.
They will be removed once in beta.

command 25 8

is index the currently selected NTFS volume.

write 232

is pipe was closed.

So this just means the Everything GUI was killed while still indexing.
Nothing to worry about. The Everything Service is still running fine after this error.

[therube]

So what, I killed the GUI - certainly possible, probable.
And during that time, even though I did kill the GUI, the building of the .db still processes (it does) & when finished, it writes out to disk (yes, I've seen that).

And then what?
I re-opened Everything, presumably the .db was still building, & at some point during that time, that is when I would have gotten the "Everything, requires administrative priviledges to index NTFS systems." message?

So the message... was correct-ish, for some period of time, need not have been acted upon, was not, and would have resolved itself some time thereafter?

[void]

So what, I killed the GUI - certainly possible, probable.
And during that time, even though I did kill the GUI, the building of the .db still processes (it does) & when finished, it writes out to disk (yes, I've seen that).

The GUI creates and maintains the index.
The GUI writes the index to disk on exit.
Killing the GUI will not show the "Everything requires administrative privileges to index system NTFS volumes" message.
Maybe the service was accidentally killed here?

And then what?
I re-opened Everything, presumably the .db was still building, & at some point during that time, that is when I would have gotten the "Everything requires administrative privileges to index system NTFS volumes" message?

It's certainly possible the service crashed.
The Event Viewer shows service crashes.
1401a will fix a race condition when Everything automatically starts the Everything Service and creating a new index before the service really starts.
Killing the Everything Service during a rebuild will definitely trigger the "Everything requires administrative privileges to index system NTFS volumes" message.

So the message... was correct-ish, for some period of time, need not have been acted upon, was not, and would have resolved itself some time thereafter?

The "Everything requires administrative privileges to index system NTFS volumes" dialog can be "triggered" when indexing a volume fails with error 5 (access denied) and the service doesn't respond to an index request.
When the indexing finishes, the "Everything requires administrative privileges to index system NTFS volumes" dialog is shown if triggered.
-It's not shown immediately.

When showing the "Everything requires administrative privileges to index system NTFS volumes" dialog, Everything checks if the service is running.
If the service is running, the dialog is not shown, even when triggered.

If this dialog is shown, the service is definitely not running.