Service Control Manager

Service Control Manager (SCM) is a special system process under the Windows NT family of operating systems, which starts, stops and interacts with Windows service processes.[1] It is located in the `%SystemRoot%\System32\services.exe` executable. Service processes interact with SCM through a well-defined API, and the same API is used internally by the interactive Windows service management tools such as the MMC snap-in `Services.msc` and the command-line Service Control utility `sc.exe`. Terminating this file is used as a method of causing the Blue Screen of Death.

## Contents

* 1 Implementation
* 1.1 Delayed auto-start services
* 1.2 Device drivers
* 1.3 Network drive letters
* 2 See also
* 3 Notes
* 4 References

## Implementation

The SCM executable, `Services.exe`, runs as a Windows console program and is launched by the Wininit process early during the system startup.[2] Its main function, `SvcCtrlMain()`, launches all the services configured for automatic startup. First an internal database of installed services is initialized by reading the following two registry keys:

* `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder\List`, containing the names and order of service groups. Each service's registry key contains an optional `Group` value which governs the order of initialization of a respective service or a device driver, with respect to other service groups.
* `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services`, which contains the actual database of services and device drivers and is read into SCM's internal database.[3] SCM reads every service's `Group` value as well as load-order dependencies from their `DependOnGroup` and `DependOnService` registry keys.[4]

In the next step, SCM's main function `SvcCtrlMain()` calls the function `ScGetBootAndSystemDriverState()` function which checks whether the device drivers that should be started during the boot or system startup were successfully loaded, and those that have failed to do so are stored in a list called `ScFailedDrivers`. Then a named pipe `\Pipe\Ntsvcs` is created as a remote procedure call interface between the SCM and the SCPs (Service Control Processes) that interact with specific services.

Next, it calls the `ScAutoStartServices()` function which loops through all the services marked as auto-start, paying attention to the calculated load-order dependencies. In case of a circular dependency an error is noted and the service depending on a service that belongs to a group coming later in the load order is skipped. For delayed auto-start services, grouping has no effect, and those are loaded at a later stage of system startup.[5]

For each service it wants to start, the SCM calls the `ScStartService()` function which checks the name of the file that runs the service's process, ensuring that the account specified for the service is same as the account that the service process runs in. Every service that does not run in the `System` account is logged in by calling the LSASS function `LogonUserEx()`, for which LSASS process looks up "secret" passwords stored in the `HKLM\SECURITY\Policy\Secrets\` registry key, which were stored by the SCP using the `LsaStorePrivateData()` API, when the service was originally configured.[6]

Next, the `ScLogonAndStartImage()` function is called for every service whose service process has not been already launched. Service processes are created in a suspended state via the `CreateProcessAsUser()` API. Before the service process' execution is resumed, a named pipe `\Pipe\Net\NtControlPipeX` (where X is a number incremented for each service iteration) is created which serves as a communication channel between the SCM and the service process. Service process connects to the pipe by calling the `StartServiceCtrlDispatcher()` function, after which the SCM sends the service a "start" command.[7]

### Delayed auto-start services

Delayed auto-start services have been added in Windows Vista, in order to solve the problem of a prolonged system startup, as well as to speed-up the start of critical services that cannot be delayed.[8] Originally the auto-start method of service initialization was designed for essential system services upon which other applications and services depend. The SCM initializes the delayed services only after handling all the non-delayed auto-start services, by invoking the `ScInitDelayStart()` function. This function queues a delayed (120 seconds by default) work item associated with a corresponding worker thread. Other than being initialized after a delay, there are no other differences between delayed and non-delayed services.

### Device drivers

Services whose `Type` registry value is `SERVICE_KERNEL_DRIVER` or `SERVICE_FILE_SYSTEM_DRIVER` are handled specially: these represent device drivers for which `ScStartService()` calls the `ScLoadDeviceDriver()` function which loads the appropriate driver (usually a file with an extension `.sys`) which must be located in the `%SystemRoot%\System32\Drivers\` directory. For that purpose, the `NtLoadDriver` system call is invoked, and the `SeLoadDriverPrivilege` is added to the SCM's process.

### Network drive letters

SCM provides an additional functionality completely unrelated to Windows services: it notifies GUI applications such as the Windows Explorer when a network drive-letter connection has been created or deleted, by broadcasting Windows messages `WM_DEVICECHANGE`.

## See also

* Windows service
* List of Windows Services
* Operating system service management
* svchost.exe

## Notes

1. ↑ Russinovich, Solomon & Ionescu (2009:79)
2. ↑ Russinovich, Solomon & Ionescu (2009:291)
3. ↑ "Database of Installed Services". Microsoft Developer Network. http://msdn.microsoft.com/en-us/library/ms682544.aspx.
4. ↑ Russinovich, Solomon & Ionescu (2009:292)
5. ↑ Russinovich, Solomon & Ionescu (2009:294)
6. ↑ Russinovich, Solomon & Ionescu (2009:295)
7. ↑ Russinovich, Solomon & Ionescu (2009:296)
8. ↑ Russinovich, Solomon & Ionescu (2009:297)

## References

* Russinovich, Mark; Solomon, David; Ionescu, Alex (2009), Windows® Internals (5th ed.), Microsoft Press, ISBN 0-7356-2530-1

* v
* t
* e

Microsoft Windows components

Management
tools|

* App Installer
* Command Prompt
* Control Panel
* Applets
* Device Manager
* Disk Cleanup
* Disk Defragmenter
* Driver Verifier
* DxDiag
* Event Viewer
* IExpress
* Management Console
* Netsh
* Performance Monitor
* Recovery Console
* Resource Monitor
* Settings
* Sysprep
* System Configuration
* System File Checker
* System Information
* System Policy Editor
* System Restore
* Task Manager
* Windows Error Reporting
* Windows Ink
* Windows Installer
* PowerShell
* Windows Update
* Windows Insider
* WinRE
* WMI

Apps|

* Alarms & Clock
* Calculator
* Calendar
* Camera
* Character Map
* Cortana
* Edge
* Fax and Scan
* Feedback Hub
* File Manager
* Get Help
* Groove Music
* Magnifier
* Mail
* Messaging
* Maps
* Media Player
* Movies & TV
* Mobility Center
* Money
* News
* Narrator
* Notepad
* OneDrive
* OneNote
* Paint
* Paint 3D
* People
* Phone Companion
* Photos
* Quick Assist
* Snipping Tool
* Speech Recognition
* Skype
* Sports
* Sticky Notes
* View 3D
* Store
* Tips
* Voice Recorder
* Wallet
* Weather
* Windows To Go
* Windows Story Remix
* WordPad
* Xbox Console Companion
* Your Phone

Shell|

* Action Center
* Aero
* AutoPlay
* AutoRun
* ClearType
* Explorer
* Search
* Indexing Service
* IFilter
* Saved search
* Namespace
* Special folder
* Start menu
* Taskbar
* Task View
* Windows Spotlight
* Windows XP visual styles

Services|

* Service Control Manager
* BITS
* CLFS
* Multimedia Class Scheduler
* Shadow Copy
* Task Scheduler
* Error Reporting
* Wireless Zero Configuration

File systems|

* CDFS
* DFS
* exFAT
* IFS
* FAT
* NTFS
* Hard link
* Junction point
* Mount Point
* Reparse point
* Symbolic link
* TxF
* EFS
* ReFS
* UDF

Server|

* Domains
* Active Directory
* DNS
* Group Policy
* Roaming user profiles
* Folder redirection
* Distributed Transaction Coordinator
* MSMQ
* Windows Media Services
* Rights Management Services
* IIS
* Remote Desktop Services
* WSUS
* SharePoint
* Network Access Protection
* PWS
* DFS Replication
* Remote Differential Compression
* Print Services for UNIX
* Remote Installation Services
* Windows Deployment Services
* System Resource Manager
* Hyper-V
* Server Core

Architecture|

* Architecture of Windows NT
* Startup process
* NT
* Vista
* CSRSS
* Desktop Window Manager
* Portable Executable
* EXE
* DLL
* Enhanced Write Filter
* Graphics Device Interface
* hal.dll
* I/O request packet
* Imaging Format
* Kernel Transaction Manager
* Library files
* Logical Disk Manager
* LSASS
* MinWin
* NTLDR
* Ntoskrnl.exe
* Object Manager
* Open XML Paper Specification
* Registry
* Resource Protection
* Security Account Manager
* Server Message Block
* Shadow Copy
* SMSS
* System Idle Process
* USER
* WHEA
* Win32 console
* Winlogon
* WinUSB

Security|

* Security and Maintenance
* AppLocker
* BitLocker
* Credential Guard
* Data Execution Prevention
* Family Safety
* Kernel Patch Protection
* Mandatory Integrity Control
* Protected Media Path
* User Account Control
* User Interface Privilege Isolation
* Windows Defender
* Windows Firewall

Compatibility|

* COMMAND.COM
* Virtual DOS machine
* Windows on Windows
* WoW64
* Windows Subsystem for Linux

API|

* Active Scripting
* WSH
* VBScript
* JScript
* COM
* ActiveX
* ActiveX Document
* COM Structured storage
* DCOM
* OLE
* OLE Automation
* Transaction Server
* DirectX
* .NET Framework
* Universal Windows Platform
* Windows Mixed Reality
* Windows Runtime
* WinUSB

Games|

* Solitaire Collection

Discontinued|

| Games|

* 3D Pinball
* Chess Titans
* FreeCell
* Hearts
* InkBall
* Hold 'Em
* Purble Place
* Reversi
* Spider Solitaire
* Solitaire
* Tinker

|

Apps|

* ActiveMovie
* Anytime Upgrade
* Address Book
* Backup and Restore
* Cardfile
* CardSpace
* CD Player
* Contacts
* Desktop Gadgets
* Diagnostics
* DriveSpace
* DVD Maker
* Easy Transfer
* Fax
* Food & Drink
* Help and Support Center
* Health & Fitness
* HyperTerminal
* Internet Explorer
* Journal
* Media Center
* Meeting Space
* Messaging
* Messenger
* Mobile Device Center
* Movie Maker
* MSN Dial-up
* NetMeeting
* NTBackup
* Outlook Express
* Travel
* Photo Gallery
* Photo Viewer
* Program Manager
* Steps Recorder
* Syskey
* WinHelp
* Write

Others|

* ScanDisk
* File Protection
* Media Control Interface
* Next-Generation Secure Computing Base
* POSIX subsystem
* Interix
* Video for Windows
* Windows SideShow
* Windows Services for UNIX
* Windows System Assessment Tool
* WinFS

Spun off to
Microsoft Store|

* DVD Player
* Hover!
* Mahjong
* Minesweeper

0.00

(0 votes)

Original source: https://en.wikipedia.orghttps://handwiki.org/wiki/ Service Control Manager. Read more

|

Retrieved from "https://handwiki.orghttps://handwiki.org/wiki/index.php?title=Software:Service_Control_Manager&oldid=2591888"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template