SC

Service Control - Create, Create remotely, Start, Stop, Query, Delete.

SC [boot | config | continue | control | create | delete | description | enumdepend | failure | getdisplayname | getkeyname | interrogate | lock | pause | qc | qdescription | qfailure | query | queryex | querylock | sdset | sdshow | start | stop] /?

SC [\\server_name] boot [bad | OK]

SC [\\server_name] {config | create} [service_name] [binpath= binary_path_name] [depend= dependencies] [displayname= display_name] [error= {critical | ignore | normal | severe}] [group= load_order_group] [obj= {account_name | object_name}] [password= password] [start= {auto | boot | demand | disabled | system}] [tag= {yes | no}] [type= {{own | share} [type= interact] | adapt | kernel | filesys | rec}]

SC [\\server_name] {continue | delete | interrogate | pause | sdshow} [service_name]

SC [\\server_name] control [service_name] [{netbindadd | netbinddisable | netbindenable | netbindremove | paramchange | user_defined}]

SC [\\server_name] description [service_name] [description]

SC [\\server_name] {enumdepend | getdisplayname | getkeyname | qc | qdescription | qfailure} [service_name] [buffer_size]

SC [\\server_name] failure [service_name] [actions= failure_actions_and_delay_time [reset= error_free_period]] [command= command_line] [reboot= broadcast_message]

SC [\\server_name] {lock | querylock}

SC [\\server_name] {query | queryex} [service_name] [type= {all | driver | service}] [type= {adapt | interact | kernel | filesys | own | rec | share}] [state= {active | inactive | all}] [bufsize= buffer_size] [ri= resume_index] [group= group_name]

SC [\\server_name] sdset service_name service_security_descriptor

SC [\\server_name] start service_name [service_arguments]

SC [\\server_name] stop service_name

actions= failure_actions_and_delay_time (NTXP)

Specifies the failure actions and their delay time (in milliseconds) separated by the forward slash (/). These actions are valid:

• "" no action upon failure
• run
• restart
• reboot

It is possible to specify three different actions, which will be used the first, second, and third time a service fails.

binpath= binary_path_name (NTXP)

Specifies a path to the service binary file.

boot (NTXP)

Indicates whether the last boot should be saved as the last-known-good configuration.

buffer_size (NTXP)

Specifies the size (in bytes) of the enumeration buffer. The default is 1024 bytes.

bufsize= buffer_size (NTXP)

Specifies the size (in bytes) of the enumeration buffer. The default size is 1024 bytes. Increase the size of the enumeration buffer when the display resulting from a query exceeds 1024 bytes.

command= command_line (NTXP)

Specifies the command-line to be run upon failure of the service.

Not all services allow changes to their failure options. Some run as part of a service set.

To run a batch file upon failure, specify cmd.exe Drive:\FileName.bat, where Drive:\FileName.bat is the fully qualified name of the batch file.

To run a VBS file upon failure, specify cscript drive:\myscript.vbs, where drive:\myscript.vbs is the fully qualified name of the script file.

config (NT4)

Permanently modifies the value of a service's entries in the registry and in the Service Control Manager's database.

continue (NT4)

Sends a CONTINUE control request to a service in order to resume a paused service.

control (NTXP)

Sends a CONTROL B to a service.

create (NT4)

Creates a subkey and entries for the service in the registry and in the Service Control Manager's database.

delete (NT4)

Deletes a service subkey from the registry. If the service is running or if another process has an open handle to the service, then the service is marked for deletion.

depend= dependencies (NTXP)

Specifies the names of services or groups which must start before this service. The names are separated by forward slashes (/).

description (NTXP)

Sets the description string for a service.

displayname= display_name (NTXP)

Specifies a friendly, meaningful name that can be used in user-interface programs to identify the service to users.

enumdepend (NT4)

Lists the services that cannot run unless the specified service is running.

error= {critical | ignore | normal | severe} (NTXP)

Specifies the severity of the error if the service fails to start during boot:

• critical The error is logged (if possible). The computer attempts to restart with the last-known-good configuration. If the last-known-good configuration fails, startup also fails, and the boot process halts with a Stop error
• ignore The error is logged and startup continues. No notification is given to the user beyond recording the error in the Event Log
• normal The error is logged and a message box is displayed informing the user that a service has failed to start. Startup will continue. This is the default setting
• severe The error is logged (if possible). The computer attempts to restart with the last-known-good configuration. This could result in the computer being able to restart, but the service may still be unable to run

failure (NTXP)

Specifies what action to take upon failure of the service.

getdisplayname (NT4)

Gets the display name associated with a particular service.

getkeyname (NT4)

Gets the key name associated with a particular service, using the display name as input.

group= load_order_group (NTXP)

Specifies the name of the group of which this service is a member. The list of groups is stored in the registry in the HKLM\System\CurrentControlSet\Control\ServiceGroupOrder subkey. The default is null.

group= group_name (NTXP)

Specifies the service group to enumerate. The default is all groups.

interrogate (NTXP)

Sends an INTERROGATE control request to a service.

Causes the service to update its status with the Service Control Manager.

bad | OK (NTXP)

Specifies whether the last boot was bad or whether it should be saved as the last-known-good boot configuration.

lock (NT4)

Locks the Service Control Manager's database.

Use to make sure service will not be started after it has been stopped. Allows to take action without interference.

Using the lock operation locks the Service Control Manager's database and then allows the database to be unlocked by typing u. You can also kill the process from which you locked the database.

obj= {account_name | object_name} (NTXP)

Specifies a name of an account in which a service will run, or specifies a name of the Windows driver object in which the driver will run. The default is LocalSystem.

password= password (NTXP)

Specifies a password. This is required if an account other than the LocalSystem account is used.

pause (NT4)

Sends a PAUSE control request to a service.

Pause a service before shutting it down.

Not all services can be paused.

Not all services perform the same when paused. Some continue to service existing clients, but refuse to accept new clients. Others cease to service existing clients and also refuse to accept new ones.

qc (NT4)

Queries the configuration information for a service.

Administrators can determine the binary name of any service and find out if it shares a process with other services.

Can help match up services in the Services node of Microsoft Management Console (MMC) with processes in System Monitor. If the binary name is Services.exe, then the service shares the Service Controller process.

Services.exe starts all services. To conserve system resources, several Win32 services developed for Windows are written to share the Services.exe process. These services are not listed as separate processes in System Monitor or Task Manager. The same is true of Svchost.exe which is a service host process that many operating services share.

There might not be a process for every Win32 service because third-party Win32 services can also be configured to share processes. Can be used to get configuration information on these services. If a service does not share its process with other services, however, there will be a process for it in System Monitor when the service is running.

Can be useful for developers of services because it provides more detailed and accurate information about services than Services.exe, which is included with Windows. Services.exe can determine whether a service is running, stopped, or paused. Although these tools are adequate for a debugged application that is running smoothly, the information they provide about a service being developed can be misleading.

Implements calls to all Windows service control application programming interface (API) functions. Set the parameters to these functions by specifying them at the command-line.

You can query the service status and retrieve the values stored in the status structure fields. Services.exe cannot provide you with the complete status of a service, shows the exact state of the service, as well as the last checkpoint number and wait hint. You can use the checkpoint as a debugging tool because it indicates how far the initialization progressed before the program stopped responding. Also lets you specify the name of a remote computer so that you can call the service API functions or view the service status structures on a remote computer.

qdescription (NTXP)

Displays the description string of a service.

qfailure (NTXP)

Displays the actions that will be performed if the specified service fails.

query (NT4)

Obtains and displays information about the specified service, driver, type of service, or type of driver.

queryex (NT4)

Obtains and displays extended information about the specified service, driver, type of service, or type of driver.

querylock (NT4)

Queries and displays the lock status for the Service Control Manager's database.

reboot= broadcast_message (NTXP)

Specifies the message to be broadcast upon failure of the service.

reset= error_free_period (NTXP)

Specifies the length of the period (in seconds) with no failures after which the failure count should be reset to 0. Must be used in conjunction with actions=.

ri= resume_index (NTXP)

Specifies the index number at which to begin or resume the enumeration. The default is 0. Use in conjunction with the bufsize= parameter when more information is returned by a query than the default buffer can display.

When a query command exceeds the size of the enumeration buffer, a message similar to:

      Enum: more data, need 2311 bytes start resume at index 84

To display remaining query information, set bufsize= to be the number of bytes and ri= to the specified index. The remaining output would be displayed by typing:

      SC query bufsize= 2311 ri= 84

sdset (NTXP)

Sets a service's security descriptor using Service Descriptor Definition Language (SDDL).

sdshow (NTXP)

Displays a service's security descriptor using SDDL.

\\server_name (NT4)

Specifies the name of the remote server on which the service is located. The name must use the Universal Naming Convention (UNC) format.

service_arguments (NT4)

Specifies service arguments to pass to the service to be started.

service_security_descriptor (NTXP)

Specifies the service descriptor in SDDL.

{netbindadd | netbinddisable | netbindenable | netbindremove | paramchange | user_defined} (NTXP)

Specifies a control to send to a service.

description (NTXP)

Specifies a description for the specified service. If no string is specified, the description of the service is not modified. There is no limit to the number of characters that can be contained in the service description.

service_name (NT4)

The KeyName of the service, this is often but not always the same as the DisplayName shown in CPanel, Services.

Specifies the service name returned by the getkeyname operation.

start (NT4)

Starts a service running.

start= {auto | boot | demand | disabled | system} (NTXP)

Specifies the service start type:

• auto A service that automatically starts each time the computer is restarted and runs even if no one logs on to the computer
• boot A device driver that is loaded by the boot loader
• demand A service that must be manually started. This is the default value if start= is not specified
• disabled A service that cannot be started. To start a disabled service, change the start type to some other value
• system A device driver that is started during kernel initialization

state= {active | inactive | all} (NTXP)

Specifies the started state of the service for which to enumerate:

• active Specifies all active services
• all Specifies all services
• inactive Specifies all paused or stopped services

stop (NT4)

Sends a STOP control request to a service.

tag= {yes | no} (NTXP)

Specifies whether or not to obtain a TagID from the CreateService call. Tags are only used for boot-start and system-start drivers.

type= {{own | share} [type= interact] | adapt | kernel | filesys | rec} (NTXP)

Specifies the service type:

• adapt Adapter driver (identifies hardware items such as keyboard, mouse, and disk drive)
• filesys File system driver
• interact The service can interact with the desktop, receiving input from users. Interactive services must be run under the LocalSystem account. This type MUST be used in conjunction with own or share
• kernel Driver
• own The service runs in its own process. It does not share an executable file with other services. This is the default
• rec File system-recognized driver (identifies file systems used on the computer)
• share The service runs as a shared process. It shares an executable file with other services

type= {adapt | interact | kernel | filesys | own | rec | share} (NTXP)

Specifies the type of services or type of drivers to enumerate:

• adapt ?
• filesys File system driver
• interact The service can interact with the desktop, receiving input from users. Interactive services must be run under the LocalSystem account
• kernel Driver
• own The service runs in its own process. It does not share an executable file with other services. This is the default
• rec ?
• share The service runs as a shared process. It shares an executable file with other services

type= {all | driver | service} (NTXP)

Specifies the started state of the service for which to enumerate:

• active Specifies all active services, default
• all Specifies all services
• inactive Specifies all paused or stopped services

/? (NTXP)

Displays help.

DELSRV - Delete NT service.
NET HELP - manage network resources.
IF - Conditionally perform a command.
SCLIST - Display NT Services.
START /HIGH - Start a specified program or command.
Equivalent Linux BASH commands:
nice - Change job scheduling priority.

The create and config commands have a several additional options for full details just enter:

    SC create
    SC config

The SC command duplicates some aspects of the NET command but adds the ability to create a service and can run a query to see if a service is running, giving output something like this:

 SERVICE_NAME : messenger
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 4  RUNNING
                                (STOPPABLE,NOT_PAUSABLE,ACCEPTS_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

You can pipe the output into FIND in order to retrieve specific sections of the above output e.g.

    SC query messenger | FIND "RUNNING"

The FIND command will set the ERRORLEVEL:

• ERRORLEVEL 0 = Running
• ERRORLEVEL 1 = Stopped or Paused

    SC GetKeyName "task scheduler"

    SC GetDisplayName schedule

    SC start schedule

    SC query schedule

none.

External Resource Kit

DOS

none

Windows

none

Windows NT

NT4

External

DOS

none

Windows

none

Windows NT

NTXP NT2003