diff --git a/doc/Changelog b/doc/Changelog
index c1e3f2d61..02c231ebe 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,6 +1,8 @@
 19 June 2018: Wouter
 	- Fix for unbound-control on Windows and set TCP socket parameters
 	  more closely.
+	- Windows example service.conf edited with more windows specific
+	  configuration.
 
 18 June 2018: Wouter
 	- Fix that control-use-cert: no works for 127.0.0.1 to disable certs.
diff --git a/winrc/service.conf b/winrc/service.conf
index e0118a63a..32c778e79 100644
--- a/winrc/service.conf
+++ b/winrc/service.conf
@@ -4,10 +4,25 @@ server:
 	# verbosity level 0-4 of logging
 	verbosity: 0
 
+	# On windows you may want to make all the paths relative to the
+	# directory that has the executable in it (unbound.exe).  Use this.
+	#directory: "%EXECUTABLE%"
+
 	# if you want to log to a file use
 	#logfile: "C:\unbound.log"
+	# or use "unbound.log" and the directory clause above to put it in
+	# the directory where the executable is.
 
 	# on Windows, this setting makes reports go into the Application log
 	# found in ControlPanels - System tasks - Logs 
 	#use-syslog: yes
 
+	# on Windows, this setting adds the certificates from the Windows
+	# Cert Store.  For when you want to use forwarders with TLS.
+	#tls-win-cert: yes
+
+remote-control:
+	# If you want to use unbound-control.exe from the command line, use
+	#control-enable: yes
+	#control-interface: 127.0.0.1
+	#control-use-cert: no