Service Control Manager (SCM)

The Service Control Manager (SCM) is a system component that manages services on Windows. It is responsible for starting, stopping, enumerating, and configuring services. Developers interact with the SCM through a set of API functions to control the behavior of their services.

Core Responsibilities

• Service Database Management: Stores information about all installed services, including their paths, dependencies, and startup types.
• Service Control Operations: Handles requests to start, stop, pause, resume, and query the status of services.
• Dependency Resolution: Manages the order in which services are started based on their dependencies.
• Process Hosting: Launches service executables in separate processes and monitors their health.
• Error Handling: Manages service failures and can be configured to restart failed services.

Key SCM Concepts

Services and Service Types

A Windows service is an application that runs in the background without direct user interaction. Services can be classified into different types based on their behavior and interaction model:

• Kernel Driver Services: Run in kernel mode.
• File System Filter Drivers: Used to filter file system access.
• Service Drivers: Typically kernel-mode drivers.
• Own Process Services: Run in their own dedicated process.
• Shared Process Services: Run within a shared service host process (e.g., svchost.exe).

Service Dependencies

Services can have dependencies on other services or drivers. The SCM ensures that dependent services are started only after their prerequisites have started successfully. This is crucial for system stability and correct operation.

Service Startup Types

The SCM manages how services start automatically:

• Automatic: The service starts automatically when the system boots.
• Automatic (Delayed Start): The service starts automatically after other automatic services have started.
• Manual: The service can only be started manually by a user or another application.
• Disabled: The service cannot be started.

Interacting with the SCM

Developers can interact with the SCM programmatically using the Service Control Manager API. Key functions include:

OpenSCManager

This function establishes a connection to the SCM on a specified computer. It returns a handle that can be used to access service objects.

SC_HANDLE OpenSCManager(
      LPCTSTR lpMachineName,
      LPCTSTR lpDatabaseName,
      DWORD   dwDesiredAccess
    );

CreateService

Used to add a new service to the SCM database. This function requires detailed information about the service, such as its executable path, display name, and start type.

SC_HANDLE CreateService(
      SC_HANDLE  hSCManager,
      LPCTSTR    lpServiceName,
      LPCTSTR    lpDisplayName,
      DWORD      dwDesiredAccess,
      DWORD      dwServiceType,
      DWORD      dwStartType,
      DWORD      dwErrorControl,
      LPCTSTR    lpBinaryPathName,
      LPCTSTR    lpLoadOrderGroup,
      LPDWORD    lpdwTagId,
      LPCTSTR    lpDependencies,
      LPCTSTR    lpServiceStartName,
      LPCTSTR    lpPassword
    );

StartService

Initiates the starting of a specified service.

BOOL StartService(
      SC_HANDLE hService,
      DWORD     dwNumServiceArgs,
      LPCSTR    *lpServiceArgVectors
    );

ControlService

Sends a control code to a service to request an operation, such as stopping, pausing, or resuming.

BOOL ControlService(
      SC_HANDLE hService,
      DWORD     dwControl,
      LPSERVICE_STATUS lpServiceStatus
    );

QueryServiceStatus

Retrieves the current status of a service.

BOOL QueryServiceStatus(
      SC_HANDLE hService,
      LPSERVICE_STATUS lpServiceStatus
    );

CloseServiceHandle

Closes an open service control manager or service handle.

BOOL CloseServiceHandle(
      SC_HANDLE hSCObject
    );

SCM Configuration Tools

While direct API interaction is common for programmatic control, the SCM is also configurable through standard Windows tools:

• Services Console (services.msc): A graphical interface for managing services, including starting, stopping, and changing startup types.
• Command Prompt (sc.exe): A powerful command-line utility for service control and configuration. For example:
  • sc query [servicename] - Query service status.
  • sc start [servicename] - Start a service.
  • sc stop [servicename] - Stop a service.
  • sc config [servicename] start=auto - Change startup type to automatic.

Security Considerations

Access to SCM operations is protected by security descriptors. Only users with appropriate privileges can install, configure, or control services. Services often run under specific user accounts (e.g., Local System, Network Service, Local Service) which define their access rights and security context.