Service Control - Create, Start, Stop, Query or Delete any Windows SERVICE. The command options for SC are case sensitive.
Syntax
Indicate whether the last boot should be saved as the last-known-good boot configuration:
SC [\\server] boot {OK | bad}
Configure a service:
SC [\\server] config service_name [option1] [option2]...
CONTINUE a service:
SC [\\server] continue [service_name]
Send a control to a service:
SC [\\server] control [service_name] [{paramchange | netbindadd | netbindremove | netbindenable
| netbinddisable | UserDefinedControlB}]
Create a service (add it to the registry):
SC [\\server] create service_name [binPath= ] [option1] [option2]...
Delete a service (from the registry):
SC [\\server] delete [service_name]
Change the description of a service:
SC [\\server] description [service_name] [Description]
Enumerate service Dependencies:
SC [\\server] enumdepend [service_name] [BufferSize]
Change the actions taken by a service upon failure: (delay times in MS milliseconds)
SC [\\server] failure [service_name] [reset= ErrorFreePeriod] [reboot= BroadcastMessage]
[command= CommandLine] [actions= {"" | {[run/MS] | [restart/MS] | [reboot/MS]}[/...]]
ErrorFreePeriod Specifies the number of seconds with no failures after which the failure
count will reset to 0. This parameter requires the actions= parameter.
Change the failure actions flag of a service:
SC [\\server] failureflag [service_name] [Flag]
The default flag value is 0 (no action). If this is set to 1, and if the user has already
configured recovery actions for service failures, then the recovery actions will also be
triggered if the service stops because of an error.
Get the DisplayName of a service:
SC [\\server] getdisplayname [service_name] [BufferSize]
Get the ServiceKeyName of a service:
SC [\\server] getkeyname [service_name] [BufferSize]
Send an INTERROGATE control request to a service:
SC [\\server] interrogate [service_name]
Lock the services database:
Locking the Service Control Manager's database prevents any services from starting.
Use this command if you want to make sure that a service will not be started after it
has been stopped. This will enable you to perform an action (for example, deleting the service)
without interference. Unlock the database by typing u.
You can also stop the process from which you locked the database.
SC Lock
Query the LockStatus for the SCManager Database:
This will show if a service request is running.
SC Querylock
Change the service to mark the service account as being managed by LSA:
SC [\\server] managedserviceaccount [service_name] {true | false}
Set the preferred NUMA mode of a service you own: (to remove this, set Node No. to -1)
SC [\\server] preferrednode [service_name] [Node-Number]
Change the required privileges of a service:
(separate multiple privs with / e.g. SeBackupPrivilege/SeRestorePrivilege)
SC [\\server] privs [service_name] [privileges]
PAUSE a service:
SC [\\server] pause [service_name]
Query the configuration:
SC [\\server] qc [service_name] [BufferSize]
Query the configuration:
SC [\\server] qc [service_name] [BufferSize]
Query the description of a service:
SC [\\server] Qdescription [service_name] [BufferSize]
Query the actions taken by a service upon failure:
SC [\\server] Qfailure [service_name] [BufferSize]
Query whether the service uses an account with a password managed by LSA:
SC [\\server] Qmanagedaccount [service_name]
Query the preferred NUMA node of a service:
SC [\\server] Qpreferrednode [service_name]
Query the process protection level of a service:
SC [\\server] Qprotection [service_name]
Query the required privileges of a service:
SC [\\server] Qprivs [service_name] [BufferSize]
Query the service SID Type of a service: (RESTRICTED / UNRESTRICTED / NONE)
SC [\\server] Qsidtype [service_name]
Query the trigger parameters of a service:
SC [\\server] Qtriggerinfo [service_name] [BufferSize]
Query for a local instance of a User Service Template:
SC [\\server] Quserservice [Service_Template_Name]
Show status of a service or enumerate the status for types of service:
SC [\\server] query [service_name] [type= {driver | service | all}]
[type= {own | share | interact | kernel | filesys | rec | adapt}]
[state= {active | inactive | all}]
[bufsize= Buffersize] [ri= Resumeindex] [group= groupname] [/?]
The type= parameter can be used twice in some cases. The first appearance specifies
whether to query services, drivers, or both (all). The second appearance of the type= parameter
specifies a type from the create operation to further narrow a query's scope.
Show extended information, pid, flags:
SC [\\server] queryex [service_name] [type= {driver | service | userservice | all}]
[type= {own | share | interact | kernel | filesys | rec | adapt}]
[state= {active | inactive | all}] [bufsize= BufferSize]
[ri= ResumeIndex] [group= {"" | GroupName}] [/?]
Set a service’s security descriptor using SDDL:
SC [\\server] sdset service_name ServiceSecurityDescriptor
Display a service’s security descriptor using SDDL:
SC [\\server] sdshow service_name
Display the service SID string corresponding to an arbritary name:
(name can be an existing or non-existent service)
SC [\\server] showsid name
Change the service SID Type of a service:
SC [\\server] sidtype [service_name] {none | unrestricted | restricted}
START a service:
SC [\\server] start service_name [ServiceArguments]
STOP a service:
SC [\\server] stop service_name
Configure the trigger parameters of a service:
(list the options with SC triggerinfo)
SC [\\server] triggerinfo [service_name] [option1] [option2]...
Key
server : The machine where the service is running
service_name : The KeyName of the service, this is often but not always
the same as the DisplayName shown in Control Panel, Services.
You can get the KeyName by running:
SC GetKeyName DisplayName
BufferSize : Size of the enumeration/display buffer in bytes, Default = 1024.
When the display resulting from a command exceeds the size of the buffer,
a message similar to the following is displayed:
Enum: more data, need 2130 bytes start resume at index 75
The remaining output could be displayed by typing:
sc queryex bufsize= 2130 ri= 75
qryOpt:
type= driver|service|all
Query specific types of service.
state= active|inactive|all
The started state of the service to be enumerated.
bufsize= bytes
ri= resume_index_number (default=0)
group= groupname
Query services in a particular group.
Options for Create and Config:
binPath= BinaryPathName to the .exe file
depend= Dependencies (separated by / (forward slash))
DisplayName= display_name
error= { normal|severe|critical|ignore }
group= LoadOrderGroup
obj= { AccountName|ObjectName }
password= password
start= { boot|system|auto|demand|disabled|delayed-auto }
tag= { yes|no }
type= { own|share|interact|kernel|filesys|rec|userown|usershare }
Defaults when creating a service: type= own, start= demand, error= normal, obj= LocalSystem
NOTE: The option name includes the equal sign. A space is required between the equal sign and
the value. e.g. to disable a service: SC config "Name of Service" start= disabled
The qryOpt options above are case sensitive, they must be entered in lower case.
If [service_name] is left blank, most SC commands will display help.
Kernel device drivers are not displayed in the Windows Control Panel ➞ Services but can be displayed by SC.
SC query will display if a service is running, giving output like this:
SERVICE_NAME : messenger TYPE : 20 WIN32_SHARE_PROCESS STATE : 4 RUNNING (STOPPABLE,NOT_PAUSABLE,ACCEPTS_SHUTDOWN) WIN32_EXIT_CODE : 0 (0x0) SERVICE_EXIT_CODE : 0 (0x0) CHECKPOINT : 0x0 WAIT_HINT : 0x0To retrieve specific information from SC’s output, pipe into FIND or FindStr
e.g.C:\> SC query messenger | FIND "STATE" | FIND "STOPPED" C:\> SC query messenger | FIND "STATE" | FIND "RUNNING"The statements above will return an %ERRORLEVEL% = 1 if the text is not found
IF errorlevel 1 GOTO :my_subroutine
The NET START command can be used in a similar way to check if a service is running:NET START | FIND "Service name" > nul IF errorlevel 1 ECHO The service is not runningWatch out for extra spaces:
SC QUERY state= all Works
SC QUERY state =all Fails!
Start the schedule service:
SC start schedule
The service control manager will normally wait up to 30 seconds to allow a service to start, you can modify this time (30,000 milliseconds) in the registry
HKLM\SYSTEM\CurrentControlSet\Control
ServicesPipeTimeout (REG_DWORD)Some options only take effect at the point when the service is started e.g. the SC config command allows the executable of a service to be changed. When the service next starts up it will run the new executable. Config changes requires the current user to have “permission to configure the service”.
Like every other external command SC can be run under PowerShell instead of CMD, however there is one extra complication for SC and that is the standard PowerShell alias SC which redirects to the Set-Content cmdlet.
To avoid that, use the call operator to run SC.exe from PowerShell:
& sc.exe
Find the service name given a display name:
SC GetKeyName "task scheduler"
Find a display name given a service name:
SC GetDisplayName schedule
Query a service state:
SC QUERY schedule
Start a service:
SC start schedule
Disable a service:
SC CONFIG "Schedule" start= disabled
Delete a service:
SC delete MyDemoSvc
List all drivers:
SC QUERY type= driver
List all services:
SC QUERY state= all |findstr "DISPLAY_NAME STATE" >svc_installed.txt
Display extended information about all service groups:
SC queryex group= ""
Configure a service:
SC \\Server64 CONFIG myService obj= ServiceAcct64 password= pa55w0rd
SC CONFIG MyService binPath=c:\myprogram.exe obj=".\LocalSystem" password=""
Disable Windows Update:
SC config wuauserv start= disabled NET stop wuauserv SC config bits start= disabled NET stop bits SC config dosvc start= disabled NET stop dosvc
Re-enable Windows Update:
SC config wuauserv start= auto NET start wuauserv SC config bits start= disabled NET start bits SC config dosvc start= disabled NET start dosvc
Enable remote registry access on computer64:
SC \\computer64 config remoteregistry start= auto SC \\computer64 start remoteregistry
“There is always room at the top” ~ Daniel Webster
NET service - Start/Stop services.
PsService - View and control services.
SUBINACL - Set service permissions.
WMIC SERVICE - WMI access to services.
Win32_Service class error return codes.
List of Windows Services
Q251192 - Create a Windows Service using SC.
Q166819 - Control Services Remotely.
Q170738 - Debug a Windows Service.
Equivalent PowerShell:
Get-Service - Get a list of services.
New-Service - Create a new service.
Invoke-CimMethod - Start/stop services via CIM.
Restart-Service - Stop and then restart a service.
Resume-Service - Resume a suspended service.
Set-Service - Change the start mode/properties of a service.
Start-Service - Start a stopped service.
Stop-Service - Stop a running service.
Equivalent bash command (Linux): nice - Change job scheduling priority.
