How to Use the sc Command in Windows 11 to Manage, Query, and Configure Windows Services

Windows operating systems execute background processes, network listeners, and system daemons through the Service Control Manager (SCM). While the graphical Services management console (services.msc) and PowerShell cmdlets (Get-Service, Set-Service) facilitate basic inspection, low-level service lifecycle orchestration and deployment automation require the native sc.exe (Service Control) utility. Operating directly against the Win32 Service API, sc enables system engineers and administrators in Windows 11 to query deep thread states, configure binary paths and dependencies, install custom services, define granular crash recovery actions, and inspect Security Descriptors (SDDL) without graphical overhead.

The Service Control Manager (SCM) Architecture

The Service Control Manager (services.exe) starts during early Windows kernel initialisation, acting as the RPC server that maintains the database of installed services and driver packages. The table below outlines how sc.exe interacts with SCM parameters:

Command Verb	Primary Technical Function	SCM State Impact	Administrative Context
query / queryex	Queries real-time service state, PID, Win32 exit codes, and flags.	Read-only; queries active SCM memory cache.	Isolating unresponsive services and identifying process IDs.
config	Modifies service start types, binary paths, account credentials, and dependencies.	Commits changes to HKLM\SYSTEM\CurrentControlSet\Services.	Hardening service start types and updating service accounts.
create	Registers a new binary or script as a recognized Win32 service.	Creates a new service registry subkey and SCM database entry.	Deploying custom in-house daemons and background agents.
failure / failureflag	Configures automated recovery actions upon unexpected process termination.	Defines restart delays, reboot actions, or recovery scripts.	Building fault-tolerant enterprise server configurations.
sdshow / sdset	Displays or applies Security Descriptor Definition Language (SDDL) strings.	Modifies discretionary access control lists (DACLs) on the service object.	Granting non-administrative users rights to restart specific services.

Querying Service States and Process IDs with sc queryex

All service administration requires exact service key names. Note that a service’s friendly display name (e.g., Windows Update) often differs from its internal service key (wuauserv).

1. Basic Status Queries

To inspect whether the Windows Event Log service is running:

sc query EventLog

2. Extracting Process IDs (PIDs) with sc queryex

When a shared service host (svchost.exe) or standalone service hangs, standard sc query does not output the PID. Use queryex to expose the exact operating system process identifier:

sc queryex Spooler

The output provides the PID (e.g., PID : 3824), allowing administrators to terminate frozen threads using taskkill /PID 3824 /F if standard stopping procedures stall.

3. Filtering Services by Operational Type and State

To query all driver services currently active on the host:

sc query type= driver state= active

Syntax Rule: In all sc commands, there must be a mandatory space immediately following the equal sign (e.g., type= driver, never type=driver).

Controlling Service Lifecycles: Start, Stop, and Pause

Executing lifecycle verbs triggers synchronous requests to the Service Control Manager:

# Start a stopped service
sc start wuauserv

# Stop an active service
sc stop wuauserv

# Pause a service that supports interactive pausing (e.g., Print Spooler)
sc pause Spooler

# Resume a paused service
sc continue Spooler

Configuring Service Startup Types with sc config

To automate or disable services, use sc config. Always remember to include the space after each option switch.

1. Altering the Start Type Parameter

# Set service to Automatic start at boot
sc config wuauserv start= auto

# Set service to Automatic (Delayed Start) to optimize boot speed
sc config wuauserv start= delayed-auto

# Set service to Manual (triggers only when demanded by apps)
sc config wuauserv start= demand

# Completely disable the service
sc config wuauserv start= disabled

2. Binding Service Dependencies

To ensure a custom service only initialises after its underlying database or network stack is operational:

sc config CustomAppService depend= Tcpip/LanmanServer

Multiple dependencies are separated by forward slashes.

Creating and Deleting Services with sc create

To register a custom worker executable as a background Windows service that launches automatically at boot:

sc create WorkerDaemon binPath= "C:\Enterprise\Services\worker.exe --prod" DisplayName= "Enterprise API Worker" start= auto obj= "NT AUTHORITY\LocalService"

Parameter breakdown:

• WorkerDaemon: Internal registry service key.
• binPath= "...": Complete executable path and command-line flags, enclosed in quotation marks.
• DisplayName= "...": Human-readable string rendered inside services.msc.
• start= auto: Automatically initialises at system startup.
• obj= "NT AUTHORITY\LocalService": Enforces least-privilege execution, avoiding standard LocalSystem elevation.

To permanently delete a deprecated service:

sc delete WorkerDaemon

Configuring Crash Recovery Policies with sc failure

Production environments require services to automatically recover from unhandled runtime exceptions without administrative intervention.

sc failure WorkerDaemon reset= 86400 actions= restart/5000/restart/10000/run/60000 command= "C:\Scripts\AlertAdmin.bat"

Policy logic:

• reset= 86400: Resets the failure counter to zero if no crashes occur within 24 hours (86,400 seconds).
• actions= restart/5000/restart/10000/run/60000:
  1. First failure: Restarts the service after 5 seconds (5,000 ms).
  2. Second failure: Restarts the service after 10 seconds (10,000 ms).
  3. Subsequent failures: Executes the batch script C:\Scripts\AlertAdmin.bat after 60 seconds.

Troubleshooting Common Service Errors

When services fail to respond or throw execution errors, apply the following diagnostic remediations:

• Error 1053: The service did not respond to the start or control request in a timely fashion: Occurs when a plain console executable (that lacks Win32 service dispatch handlers) is registered directly via sc create. Standard executables must be wrapped using service wrapper utilities (such as NSSM or WinSW) so they can respond to the SCM’s mandatory 30-second handshake check.
• Syntax Error: [SC] OpenService FAILED 1060: The specified service does not exist: You passed the user-facing display name rather than the internal service key. Query the key name via sc GetKeyName "Windows Update" to retrieve wuauserv.
• Access is Denied (Error 5): Modifying SCM entries strictly requires administrative elevation. Ensure your Command Prompt or PowerShell terminal is launched via Run as administrator.