# Option to Enable/Disable Services

IQService has a configuration option to disable unwanted services from an IQService installation.

IQService provides multiple services to communicate to different windows-based end systems. It is possible that for a given deployment, not all services are required. Services which are not required in your deployment can be disabled.

| Service Name | Description |
| --- | --- |
| AD | This service is used to communicate with Active Directory. |
| Lotus Domino | This service is used when Delta aggregation/change password is to be performed for a Lotus Domino source. |
| ScriptExecutor | This service is used to run native before and after provisioning scripts. |
| SharePointServer | This service is used if a SharePoint server source is configured. |
| AzureAD | This service is used when native before and after provisioning scripts need to be executed or when Exchange Online mailbox management is to be performed. |
| WinLocal | This service is used if a Windows Local source is configured. |
| GMSAPasswordData | This service allows IQService to retrieve clear-text passwords for Group Managed Service Accounts (gMSA) from Active Directory using Windows PowerShell. |

## Viewing the Current Status of Services

To view the enabled or disabled status of services, run `IQService.exe -g`.

To toggle the state, run the following command:

```text
IQService.exe -g <Service Name>
IQService.exe -g AD
```

Multiple services must be separated by semicolon:

```text
IQService.exe -g AD;LotusDomino
```

> [!NOTE]
>
> Restart IQService when service status is updated.

## Services Enabled by Default

The following IQService services are enabled by default:

- AD
- LotusDomino
- SharePointServer

## Services Disabled by Default

The following IQService services are disabled by default:

- **ScriptExecutor** - native before and after provisioning scripts (including when the `nativeRules` feature is configured on an Active Directory source).
- **GMSAPasswordData** - gMSA password retrieval from Active Directory.

The ScriptExecutor and GMSAPasswordData services are disabled by default. Related functionality does not work unless IQService is configured to communicate over TLS and an administrator explicitly enables the required service.

**To configure TLS and enable services after upgrading from a previous version:**

1. Configure IQService to communicate over TLS, for example:

   ```text
   IQService.exe -o <TLS_Port>
   ```

   Refer to [Secure Communication Between VA and IQService](<https://documentation.sailpoint.com/connectors/iqservice/help/security/secure_communication.html>) for TLS configuration instructions.
2. Enable each service your deployment requires, for example:

   ```text
   IQService.exe -g --enable ScriptExecutor
   IQService.exe -g --enable GMSAPasswordData
   ```
3. Restart IQService after you update service status.

To disable a service explicitly, run `IQService.exe -g --disable <Service Name>`.

Refer to [Before/After Scripts for IQService](<https://documentation.sailpoint.com/connectors/iqservice/help/before_after_scripts.html>) for native before and after provisioning scripts. Refer to [Using gMSA as a Service Account](<https://documentation.sailpoint.com/connectors/iqservice/help/gmsa_service_account.html>) for gMSA configuration.