How to Use the sc.exe Command in Windows 11 to Manage, Query, and Configure Windows Services

Windows background services are the operational backbone of Windows 11, running system daemons, network listeners, security agents, and enterprise endpoint management software silently without requiring an interactive user session. While the graphical Services Management Console (services.msc) and PowerShell cmdlets (like Get-Service and Set-Service) provide basic administrative oversight, they lack granular control over Service Control Manager (SCM) communication buffers, service binary creation, security descriptor permissions, and boot-phase service dependencies.

The native command-line utility for communicating directly with the Windows Service Control Manager is sc.exe (Service Control). By making low-level Remote Procedure Calls (RPC) to the SCM subsystem (services.exe), sc.exe enables systems engineers and automated deployment pipelines to create new background services, query real-time process identifiers (PIDs), modify binary execution paths, reconfigure startup modes, and diagnose hung service states. This technical implementation guide covers the operational syntax of sc.exe, service creation, dependency mapping, security descriptor auditing, and troubleshooting common command formatting errors.

Architecture of the Service Control Manager (SCM)

The Service Control Manager maintains the registry database of installed services under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. The sc.exe command manipulates this database through specific operational parameters:

sc.exe Sub-Command	Primary Function	Administrative Application
sc query [servicename]	Queries the active status, state machine code, exit codes, and check points of a service.	Verifying if a service is running, paused, or stuck in a start-pending transition.
sc queryex [servicename]	Extended query returning the exact operating system Process Identifier (PID) and memory flags.	Isolating and force-terminating hung services using taskkill /PID.
sc qc [servicename]	Queries the static configuration: binary path, startup type, account context, and dependencies.	Auditing service execution binaries and unquoted service path vulnerabilities.
sc create [servicename] ...	Registers a new service entry in the SCM database.	Installing custom background daemons, monitoring agents, and developer binaries.
sc config [servicename] ...	Modifies service startup parameters, display names, and service credentials.	Automating service startup changes across enterprise fleet scripts.
sc delete [servicename]	Deletes a service subkey from the Windows registry.	Completely removing orphaned or deprecated third-party service leftovers.

Crucial Syntactic Rule: The Space After the Equal Sign

A notorious syntactic requirement of sc.exe is that every configuration parameter requires a space immediately following the equal sign (e.g., start= auto, not start=auto; binpath= "C:\path", not binpath="C:\path"). Omitting this trailing space causes the parser to fail with invalid syntax errors.

Step 1: Querying Active Service Status and Identifying PIDs

Open an elevated Command Prompt or Windows PowerShell terminal (Run as Administrator) to inspect target services:

# Query basic status of the Windows Update service (wuauserv)
sc query wuauserv

# Query extended status to retrieve the host Process Identifier (PID)
sc queryex wuauserv

The extended query output reveals critical process telemetry:

SERVICE_NAME: wuauserv 
        TYPE               : 20  WIN32_SHARE_PROCESS 
        STATE              : 4  RUNNING 
                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
        PID                : 3840
        FLAGS              :

If a service is stuck in STOP_PENDING, use the extracted PID (e.g., 3840) to force termination cleanly: taskkill /F /PID 3840.

Step 2: Inspecting Service Configurations with sc qc

Before modifying binary arguments or accounts, audit the service definition:

# Query full service configuration parameters
sc qc wuauserv

Examine the BINARY_PATH_NAME. If the executable path contains spaces and is not enclosed in quotation marks (such as C:\Program Files\App\service.exe), it represents an unquoted service path vulnerability that attackers can exploit for privilege escalation.

Step 3: Creating a Custom Background Service

To register a custom monitoring binary or enterprise script engine as an official Windows service:

# Create a new automatic service running under LocalSystem context
sc create CustomMonitor binpath= "\"C:\Services\CustomMonitor.exe\" --daemon" start= auto DisplayName= "Enterprise Custom Monitor" depend= Tcpip/LanmanServer

Notice the structure:

• binpath= "\"C:\path...\"": Escaped internal quotation marks ensure paths containing spaces are securely contained.
• start= auto: Instructs SCM to start the service during early boot phases (alternatives include demand for manual, delayed-auto for delayed automatic, and disabled).
• depend= Tcpip/LanmanServer: Declares that this service will not initialize until the network protocol and SMB services are active.

Step 4: Modifying Existing Service Startup Configurations

To reconfigure existing system services across multiple Windows 11 machines via automation scripts:

# Change service startup type to delayed automatic
sc config CustomMonitor start= delayed-auto

# Assign dedicated service account credentials
sc config CustomMonitor obj= "DOMAIN\svc_monitor" password= "SecurePassword123!"

# Update the service description
sc description CustomMonitor "Continuously monitors server endpoint telemetry and network sockets."

Auditing and Configuring Service Security Descriptors (Permissions)

Enterprise hardening requires restricting which users can stop, start, or delete critical services. Use sc sdshow and sc sdset to view and apply Security Descriptor Definition Language (SDDL) strings:

# Display the current security descriptor SDDL string for a service
sc sdshow CustomMonitor

# Returns SDDL format:
# D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)

Here, SY denotes LocalSystem, BA denotes Built-in Administrators, and IU denotes Interactively Logged-On Users, controlling granular permission flags like CC (Query Conf), DC (Change Conf), and SW (Start/Stop).

Troubleshooting Common sc.exe Formatting and Runtime Errors

Error Output	Underlying Cause	Corrective Action
[SC] OpenSCManager FAILED 5: Access is denied.	Command executed from standard unprivileged command line.	Launch Windows Terminal / Command Prompt with Run as Administrator.
[SC] GetConfig FAILED 1060: The specified service does not exist...	Targeting the Display Name rather than the short internal Service Name.	Query using the internal Service Name (e.g., wuauserv, not Windows Update).
[SC] CreateService FAILED 87: The parameter is incorrect.	Missing space after the equal sign in a configuration parameter.	Re-run ensuring strict spacing: start= auto and binpath= "...".
Service marked for deletion but still appears in list	Registry key locked because services.msc or an active handle remains open.	Close all Services consoles, task managers, and event viewers; service will purge automatically.

Mastering the sc.exe command line utility equips Windows systems administrators with direct, scriptable control over the Service Control Manager, accelerating troubleshooting and standardizing background daemon management.