What are NT Services?

Part of what makes this a confusing question is that the word "services" is used in several distinct senses:

1. People often refer to "system services" or "kernel services." These are features and functions provided by the operating system for the use of applications. Our "services" will make extensive use of these, but this is not what we're talking about.
2. Driver services - we're not going to focus on these, but they can be very important (MetaFrame, for instance)
3. Win32 services - these are what we're interested in

When you ask most people who work with NT to describe services, you'll get the generic, common understanding. This is good enough most of the time, it is based on generalities, and none of them apply to all services:

1. Started automatically
2. Always running
3. Don't depend on users
4. Even Microsoft contributes to the misunderstandings:
   Running as a Windows NT Server service allows a server application to impersonate a client while accessing objects and performing actions on behalf of the client. This capability ensures that the server application can act on behalf of a client without running with an inappropriately high privilege level. It also ensures that the server application will not be able to perform actions that would be denied the client directly.

   By starting automatically, a server application implemented as a service is guaranteed to be available so long as Windows NT Server is running. Moreover, related services can be started easily and, where appropriate, automatically.

   Finally, implementing a server application as a service allows the application to be installed and controlled using standard user and Win32 APIs. Such a service can be started and stopped both locally and remotely, providing network administrators an easy and consistent way to control the service across the network.

   --BackOffice Programmer's Reference: Developing Applications in the Microsoft BackOffice Environment

So let's offer a more precise definition: a Win32 service is really just a Win32 executable that has the following characteristics:

1. Lifetime is controlled by SCM (Service Control Manager)
   • Registered with SCM
   • Understands and obeys SCM's commands
2. Has its own NT login session, or shares one with another service
   • Runs either as a user or LocalSystem
   • Subject to applicable NT security
3. Implements a set of service-specific functions
   • Starting up
   • Message handlers
   • Communicating back to the SCM