How to Use the sc failure Command in Windows 11 to Configure Automatic Service Recovery Actions

Windows Services manage critical background infrastructure, including database engines, web servers, print spoolers, and enterprise security agents. When a critical service crashes unexpectedly due to memory leaks, unhandled exceptions, or transient network timeouts, manual administrative intervention results in costly downtime. Windows 11 includes the sc.exe (Service Controller) utility, which provides the failure subcommand. Using sc failure, administrators can programmatically configure automated recovery policies that restart the service, run diagnostic triage scripts, or reboot the operating system upon failure.

Launching Elevated Administrative Terminal Console

Modifying Windows Service recovery parameters alters protected service configurations in the system registry (HKLM\SYSTEM\CurrentControlSet\Services). Open an elevated command line:

1. Press Win + X and select Terminal (Admin) or PowerShell (Admin).
2. Confirm the User Account Control (UAC) prompt to proceed.

Querying Existing Service Failure Actions with sc qfailure

Before modifying recovery behaviors, query the current failure settings of a target service using sc qfailure:

sc qfailure Spooler

The command outputs the active recovery policy configuration:

[SC] QueryServiceConfig2 SUCCESS
SERVICE_NAME: Spooler
        RESET_PERIOD (in seconds)    : 86400
        REBOOT_MESSAGE               :
        COMMAND_LINE                 :
        FAILURE_ACTIONS              : RESTART -- Delay = 60000 milliseconds.
                                       RESTART -- Delay = 120000 milliseconds.
                                       NONE    -- Delay = 0 milliseconds.

Understanding the Syntax of sc failure

The sc failure command requires strict parameter syntax, notably requiring an exact space after each equal sign:

sc failure [ServiceName] reset= [Seconds] actions= [Action/Delay/Action/Delay/...]

Key parameters explained:

• reset= [Seconds]: The time window in seconds during which the failure count is tracked. If no crashes occur within this period, the failure counter resets to zero.
• actions= [Action/Delay]: Defines the recovery response and delay in milliseconds, paired with a slash. Supported actions:
  • restart: Automatically restarts the service.
  • run: Executes a custom batch script or executable.
  • reboot: Triggers a system reboot.
  • "": Takes no action.

Configuring Automatic Service Restart on Failure

To configure a service (such as W3SVC or a custom database service) to restart after 1 minute (60,000 ms) on the first crash, restart after 2 minutes on the second crash, and take no action on subsequent crashes, resetting the counter after 24 hours (86,400 seconds):

sc failure MyService reset= 86400 actions= restart/60000/restart/120000/""/0

If executed correctly, the console returns [SC] ChangeServiceConfig2 SUCCESS.

Executing an Automated Triage Script upon Subsequent Failures

When persistent failures occur, you can instruct Windows to execute a PowerShell diagnostic script to collect logs or alert the sysadmin team before attempting a restart:

sc failure MyService command= "C:\Scripts\AlertAdmin.bat" actions= restart/30000/run/60000/""/0

The command parameter assigns the exact script path executed during the run failure cycle.

Configuring System Reboot on Critical Service Failures

For domain controllers, core clustering services, or critical hypervisor daemons where continuous operation is mandatory, configure an automated server reboot on subsequent failures:

sc failure MyService reboot= "Server rebooting due to critical service crash." actions= restart/60000/reboot/120000

The reboot= parameter broadcasts a broadcast shutdown warning message to all logged-in users before triggering the restart.

Resetting Failure Configurations to Defaults

To remove all automated recovery actions and return the service to manual intervention mode:

sc failure MyService reset= 0 actions= ""/0

Command Switch Reference for sc failure

Parameter	Operational Role
sc qfailure [Service]	Queries active failure actions and reset intervals.
reset= [Seconds]	Defines duration without crashes before resetting failure counter.
actions= [Act/Delay]	Defines paired action and delay in milliseconds.
command= [Path]	Declares binary or script path executed during ‘run’ action.
reboot= [Msg]	Specifies broadcast warning message displayed before rebooting.