Why and how Task Manager's Services tab hides some services<

Question

On Windows 10, if I open Task Manager, the Services tab, there are not all services I can see in Services.msc.

Also, what is Name in msc is Description in Task Manager.. The msc is connected to Local computer. Could it be that Services tab in Task Manager is connected to different computer? If so, where can I find it?

The PC is managed by corporate, I have local admin rights and needed to troubleshoot performance issues. I was looking for Cylance PROTECT service and haven't found it Task Manager services tab but it is in Service.msc..

I'm pretty confused, can somebody explain?

Thanks

EDIT 1

EDIT 2 Output of sc.exe sdshow cylancesvc is D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLORC;;;BA)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Translated by ConvertFrom-SddlString:

Owner            :
Group            :
DiscretionaryAcl : {NT AUTHORITY\SYSTEM: AccessAllowed (ChangePermissions, CreateDirectories, Delete, DeleteSubdirectoriesAndFiles, ExecuteKey, FullControl, GenericAll, GenericExecute, GenericRead, GenericWrit
                   e, ListDirectory, Modify, Read, ReadAndExecute, ReadAttributes, ReadExtendedAttributes, ReadPermissions, TakeOwnership, Traverse, Write, WriteAttributes, WriteData, WriteExtendedAttributes,
                   WriteKey), BUILTIN\Administrators: AccessAllowed (CreateDirectories, ExecuteKey, GenericExecute, GenericRead, ListDirectory, Read, ReadAttributes, ReadExtendedAttributes, ReadPermissions, Wr
                   iteExtendedAttributes)}
SystemAcl        : {Everyone: SystemAudit FailedAccess (ChangePermissions, CreateDirectories, Delete, DeleteSubdirectoriesAndFiles, ExecuteKey, FullControl, GenericAll, GenericExecute, GenericRead, GenericWrit
                   e, ListDirectory, Modify, Read, ReadAndExecute, ReadAttributes, ReadExtendedAttributes, ReadPermissions, TakeOwnership, Traverse, Write, WriteAttributes, WriteData, WriteExtendedAttributes,
                   WriteKey)}
RawDescriptor    : System.Security.AccessControl.CommonSecurityDescriptor

Perhaps worthwhile to mention I had to run the command for Cylance in elevated cmd. For randomly picked up service I can see in TaskManager it worked without elevation. Another point is that clicking on "Open Services" button in the Task Manager does nothing.. So the clear difference is that the msc runs in elevated mode while the Task Manager does not..

Answer 1

Both services.msc and Task Manager should show the same list and they both show services on the local computer.

But you are right, the names are confusing. There is an internal name, which is listed as Name in Task Manager. In services.msc you have to open the properties for a service and see the internal name listed as Service name at the top.

The Description column in Task Manager matches the Name column in services.msc.

Find Cylance PROTECT service in services.msc, open properties and remember the Service Name, in Task Manager, order by the Name column to find that service.

Tip: Rather than those two tools, use the external tool Process Hacker which allows you to search for the names of services.

Edit:

This seems clearly a permission problem. The ACL on the service is set so that a normal user can not see it.

services.msc in your case ran elevated while Task Manager didn't. That explains the difference.

services.msc may be auto-elevated depending on your UAC settings and only if you are a member of the administrators group. For normal users it runs under medium integrity level just as Task Manager does.

Best to never log in as an administrator, and just elevate processes as you need them.

In your case the developers of the Cylance service tried to hide themselves from normal users.

The aforementioned Process Hacker nicely shows the permissions on services, easier to use than sc.exe and ConvertFrom-SddlString