Service Control Manager
From Wikipedia, the free encyclopedia
The Windows Service Control Manager (SCM) (SERVICES.EXE) is a remote procedure call (RPC) server that manages creating, deleting, starting and stopping of Windows services. It is started at system boot and is RPC based so that service configuration and service control programs can manipulate services on remote machines. [1]
The service functions provide an interface for the following tasks performed by the SCM:
- Maintaining the database of installed services.
- Starting services and driver services either upon system startup or upon demand
- Enumerating installed services and driver services.
- Maintaining status information for running services and driver services.
- Transmitting control requests to running services.
- Locking and unlocking the service database.
The Service Control Manager maintains a database of installed services in the registry. The database is used by the SCM and programs that add, modify, or configure services. The HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services registry key is used for storing this database. An initial copy of the database is created when the system is installed. The database contains entries for the device drivers required during system boot. The database includes the service type, startup type, error control level, fully qualified path of the service executable, optional dependency information and optional account name and password about each installed service and driver service.
During system boot, the SCM starts all auto-start services and the services on which they depend. For example, if an auto-start service depends on a demand-start service, the demand-start service is also started automatically. The user can also manually start a service with the Services management console. The user can specify arguments for the service in the Start parameters field. A service control program can start a service and specify its arguments with the StartService function.
When a service is started, the SCM performs the following steps:
- Retrieve the account information stored in the database.
- Log on the service account.
- Load the user profile.
- Create the service in the suspended state.
- Assign the logon token to the process.
- Allow the process to execute.
