Windows service trigger start - difference manual vs automatic?
Automatic services start when the OS boots. Manual services do not. Triggers can be added to services to make them start on some event, such as an ETW event, or a USB device being plugged in, etc. Triggers can be added to either Manual or Automatic services.
An example of the trigger(s) on an Automatic (Trigger Start) service:
C:\Users\Ryan>sc qtriggerinfo dnscache
[SC] QueryServiceConfig2 SUCCESS
SERVICE_NAME: dnscache
START SERVICE
FIREWALL PORT EVENT : b7569e07-8421-4ee0-ad10-86915afdad09 [PORT OPEN]
DATA : 5355;UDP;
An example of the trigger(s) on a Manual (Trigger Start) service:
C:\Users\Ryan>sc qtriggerinfo appinfo
[SC] QueryServiceConfig2 SUCCESS
SERVICE_NAME: appinfo
START SERVICE
NETWORK EVENT : bc90d167-9470-4139-a9ba-be0bbbf5b74d [RPC INTERFACE EVENT]
DATA : 201ef99a-7fa0-444c-9399-19ba84f12a1a
START SERVICE
NETWORK EVENT : bc90d167-9470-4139-a9ba-be0bbbf5b74d [RPC INTERFACE EVENT]
DATA : 5f54ce7d-5b79-4175-8584-cb65313a0e98
START SERVICE
NETWORK EVENT : bc90d167-9470-4139-a9ba-be0bbbf5b74d [RPC INTERFACE EVENT]
DATA : fd7a0523-dc70-43dd-9b2e-9c5ed48225b1
START SERVICE
NETWORK EVENT : bc90d167-9470-4139-a9ba-be0bbbf5b74d [RPC INTERFACE EVENT]
DATA : 58e604e8-9adb-4d2e-a464-3b0683fb1480
A service can be set to Automatic, so that it starts as soon as the OS loads, but it can also stop gracefully on its own when the service has no more work to do. After it has stopped, a trigger can start it again at any time.
So to recap, both Automatic and Manual services can have triggers that manually start them. The only difference is that Automatic services start as soon as the operating system loads.