SERVICE_ERROR_IGNORE (0)
Any error the driver or service returns is ignored, and no warning is logged or displayed.
SERVICE_ERROR_NORMAL (1)
If the driver or service reports an error, an event log message is written.
SERVICE_ERROR_SEVERE (2)
If the driver or service returns an error and last known good isn’t being used, reboot into last known good; otherwise, continue the boot.
SERVICE_ERROR_CRITICAL (3)
If the driver or service returns an error and last known good isn’t being used, reboot into last known good; otherwise, stop the boot with a blue screen crash.
Type
SERVICE_KERNEL_DRIVER (1)
Device driver.
SERVICE_FILE_SYSTEM_DRIVER (2)
Kernel-mode file system driver.
SERVICE_ADAPTER (4)
Obsolete.
SERVICE_RECOGNIZER_DRIVER (8)
File system recognizer driver.
SERVICE_WIN32_OWN_PROCESS (16)
The service runs in a process that hosts only one service.
SERVICE_WIN32_SHARE_PROCESS (32)
The service runs in a process that hosts multiple services.
SERVICE_INTERACTIVE_PROCESS (256)
The service is allowed to display windows on the console and receive user input, but only on the console session (0) to prevent interacting with user/console applications on other sessions.
Group
Group name
The driver or service initializes when its group is initialized.
Tag
Tag number
The specified location in a group initialization order. This parameter doesn’t apply to services.
ImagePath
Path to the service or driver executable file
If ImagePath isn’t specified, the I/O manager looks for drivers in %SystemRoot%\System32\Drivers. Required for Windows services.
DependOnGroup
Group name
The driver or service won’t load unless a driver or service from the specified group loads.
DependOnService
Service name
The service won’t load until after the specified service loads. This parameter doesn’t apply to device drivers other than those with a start type of SERVICE_AUTO_START or SERVICE_DEMAND_START.
ObjectName
Usually LocalSystem, but it can be an account name, such as .\Administrator
Specifies the account in which the service will run. If ObjectName isn’t specified, LocalSystem is the account used. This parameter doesn’t apply to device drivers.
DisplayName
Name of the service
The service application shows services by this name. If no name is specified, the name of the service’s registry key becomes its name.
Description
Description of service
Up to 32767-byte description of the service.
FailureActions
Description of actions the SCM should take when the service process exits unexpectedly
Failure actions include restarting the service process, rebooting the system, and running a specified program. This value doesn’t apply to drivers.
FailureCommand
Program command line
The SCM reads this value only if FailureActions specifies that a program should execute upon service failure. This value doesn’t apply to drivers.
DelayedAutoStart
0 or 1 (TRUE or FALSE)
Tells the SCM to start this service after a certain delay has passed since the SCM was started. This reduces the number of services starting simultaneously during startup.
PreshutdownTimeout
Timeout in milliseconds
This value allows services to override the default preshutdown notification timeout of 180 seconds. After this timeout, the SCM will perform shutdown actions on the service if it has not yet responded.
ServiceSidType
SERVICE_SID_TYPE_NONE (0)
Backward-compatibility setting.
SERVICE_SID_TYPE_UNRESTRICTED (1)
The SCM will add the service SID as a group owner to the service process’ token when it is created.
SERVICE_SID_TYPE_RESTRICTED (3)
Same as above, but the SCM will also add the service SID to the restricted SID list of the service process, along with the world, logon, and write-restricted SIDs.
RequiredPrivileges
List of privileges
This value contains the list of privileges that the service requires to function. The SCM will compute their union when creating the token for the shared process related to this service, if any.
Security
Security descriptor
This value contains the optional security descriptor that defines who has what access to the service object created internally by the SCM. If this value is omitted, the SCM applies a default security descriptor.
Notice that Type values include three that apply to device drivers: device driver, file system driver, and file system recognizer. These are used by Windows device drivers, which also store their parameters as registry data in the Services registry key. The SCM is responsible for starting drivers with a Start value of SERVICE_AUTO_START or SERVICE_DEMAND_START, so it’s natural for the SCM database to include drivers. Services use the other types, SERVICE_WIN32_OWN_PROCESS and SERVICE_WIN32_SHARE_PROCESS, which are mutually exclusive. An executable that hosts more than one service specifies the SERVICE_WIN32_SHARE_PROCESS type.
