Section 2: Service Control Manager (SCM)

The Big Picture: The Hotel Manager

In the hotel from Section 1, someone decides who starts work, who is on duty, and what to do when a worker does not turn up. That is the manager. In Windows this manager is the Service Control Manager, or SCM.

        You / admin tools / other programs
        (services.msc, sc.exe, PowerShell, apps)
                       │  "start Spooler", "stop W32Time", "what is running?"
                       ▼
              ┌────────────────────┐
              │ SCM  (services.exe)│  ◄── reads the service list (registry)
              └──────────┬─────────┘
          starts / stops / watches
        ┌───────────┬────┴──────┬───────────┐
        ▼           ▼           ▼           ▼
    Spooler      W32Time     Dhcp        ...hundreds more

2.1 SCM Role (services.exe)

What it is: The SCM is not a separate program you can see by that name. It lives inside the process services.exe, found in C:\Windows\System32. There is always exactly one services.exe running.

How it starts. In Chapter 6 you saw the boot order: the kernel starts, then the Session Manager (smss.exe), then wininit.exe. It is wininit.exe that launches services.exe (along with the security process lsass.exe). So the SCM is one of the first user-mode programs of Windows, and it then starts all the automatic services.

Firmware ─► Boot Manager ─► Kernel ─► smss.exe ─► wininit.exe
                                                     ├─► services.exe (the SCM)
                                                     └─► lsass.exe
                                       services.exe ─► svchost.exe, other service programs

What the SCM does all day:

You can see it. In Task Manager, Details tab, find services.exe. It runs under the account SYSTEM. It cannot be ended normally; ending it would crash Windows.

Why does this matter? Because everything about services goes through this one manager, the rules are the same for every service. That makes Windows easier to run and to secure.

2.2 Service Database

What it is: The SCM must know which services exist and how each should run. It keeps this in a service database. On Windows, that database is part of the registry (the settings store you met in Chapter 8).

Where: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Under it, each service has its own key (folder), named with its service name. For example ...\Services\Spooler.

Inside that key are values (named settings). These are the important ones:

Sub-keys. Some services also have a Parameters sub-key (extra settings; for shared services this holds ServiceDll, Section 9) and a Triggers sub-key (Section 3.5).

The word "CurrentControlSet". It is a shortcut. The real data sits in ControlSet001, ControlSet002 and so on, and CurrentControlSet points to the one in use. Always read it through CurrentControlSet.

Read-only look in regedit. Press Win + R, type regedit, press Enter, then go to the path above and click a service. Only look. Do not edit values: a wrong Start or ImagePath can stop Windows booting.

A note about drivers. The same Services area also lists kernel drivers (they have Type values like 1). The SCM and the kernel use it for both. Chapter 13 covers drivers.

Real-world analogy: The service database is the staff roster: every employee, their job, when they start, who they report to, and what to do if they fail to show.

2.3 SCM API (Start/Stop/Query)

What it is: An API (Application Programming Interface) is a set of functions that programs can call to ask Windows to do things. The SCM API is the set of functions to control services. Every tool you use (services.msc, sc, PowerShell, Task Manager) uses it behind the scenes.

The main function families (names from the Windows programming interface, shown so you recognise them):

Your tools, matched to the API:

Try this (safe, read-only):

sc query type= service state= all
sc qc Spooler

Note the strange space: in sc, the equal sign is stuck to the word and then a space follows: type= service. Without that space the command fails.

Get-Service | Select-Object -First 10
Get-CimInstance Win32_Service -Filter "Name='Spooler'" | Select-Object Name, State, StartMode, StartName, PathName, ProcessId

What State can be: Stopped, Running, Paused, or the in-between states Start Pending and Stop Pending (Section 9).

Permission check. Each time a tool opens a service, the SCM checks the caller's identity against the service's security descriptor (Section 6). That is why a normal user can list services but not stop most of them.

Summary