sc — Service Control Manager CLI

What it is

sc (Service Control) is a built-in Windows command-line interface to the Service Control Manager (SCM) — the Windows subsystem that manages background services. It can start, stop, pause, and resume services; create and delete service entries; change startup type (automatic, manual, disabled); and query the detailed configuration of any service. sc is the scripting equivalent of services.msc and predates PowerShell's Get-Service/Set-Service/New-Service/Remove-Service cmdlets. Most write operations require Administrator privileges.

Availability

sc ships as C:\Windows\System32\sc.exe on Windows XP and later. Note: in PowerShell, sc is aliased to Set-Content — always use sc.exe explicitly when running sc from a PowerShell prompt.

sc /?

Output:

DESCRIPTION:
        SC is a command line program used for communicating with the
        Service Control Manager and services.
USAGE:
        sc [command] [service name] ...

        The option <server> has the form "\\ServerName"

COMMANDS:
  query          : Queries the status for a service, or
                   enumerates the status for types of services.
  queryex        : Queries the extended status for a service, or
                   enumerates the status for types of services.
  start          : Starts a service.
  pause          : Sends a PAUSE control request to a service.
  interrogate    : Sends an INTERROGATE control request to a service.
  continue       : Sends a CONTINUE control request to a service.
  stop           : Sends a STOP request to a service.
  config         : Changes the configuration of a service (permanent).
  description    : Changes the description of a service.
  failure        : Changes the actions taken by a service upon failure.
  failureflag    : Changes the failure actions flag of a service.
  sidtype        : Changes the service SID type of a service.
  privs          : Changes the required privileges of a service.
  managedaccount : Changes the service to mark the account password
                   as managed by LSA.
  qc             : Queries the configuration information for a service.
  qdescription   : Queries the description for a service.
  qfailure       : Queries the actions taken by a service upon failure.
  delete         : Deletes a service (from the registry).
  create         : Creates a service. (adds it to the registry).

Syntax

sc [\\server] <command> [service_name] [options]

Output: (varies by command)

Essential commands

Querying service status

sc query without a service name lists all running services. Specify a name to show one service. queryex adds the process ID (PID), which is useful for correlating with Task Manager.

sc query

Output:

SERVICE_NAME: AdobeARMservice
DISPLAY_NAME: Adobe Acrobat Update Service
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
...

sc queryex Spooler

Output:

SERVICE_NAME: Spooler
DISPLAY_NAME: Print Spooler
        TYPE               : 110  WIN32_OWN_PROCESS  (interactive)
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_PRESHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
        PID                : 1648
        FLAGS              :

Viewing service configuration

sc qc returns the full stored configuration: binary path, account, startup type, and dependencies. Use it before editing a service to understand the baseline.

sc qc Spooler

Output:

[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Spooler
        TYPE               : 110  WIN32_OWN_PROCESS  (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Windows\System32\spoolsv.exe
        LOAD_ORDER_GROUP   : SpoolerGroup
        TAG                : 0
        DISPLAY_NAME       : Print Spooler
        DEPENDENCIES       : RPCSS
                           : http
        SERVICE_START_NAME : LocalSystem

Starting and stopping services

sc start and sc stop send control requests to the SCM. These are synchronous — sc returns only after the service transitions to the target state (or times out).

sc stop Spooler

Output:

SERVICE_NAME: Spooler
        TYPE               : 110  WIN32_OWN_PROCESS  (interactive)
        STATE              : 3  STOP_PENDING
                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_PRESHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        CHECKPOINT         : 0x1
        WAIT_HINT          : 0x7530

sc start Spooler

Output:

SERVICE_NAME: Spooler
        TYPE               : 110  WIN32_OWN_PROCESS  (interactive)
        STATE              : 2  START_PENDING
                                (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x7d0

Changing startup type

sc config start= sets the service start mode. The value must be one of auto, delayed-auto, demand (manual), disabled, or boot/system (driver-level). Note: there is a required space between start= and the value.

rem Set a service to start automatically
sc config Spooler start= auto

Output:

[SC] ChangeServiceConfig SUCCESS

rem Disable a service
sc config RemoteRegistry start= disabled

Output:

[SC] ChangeServiceConfig SUCCESS

Creating a service

sc create registers a new service in the SCM. binPath= is the only required option besides the service name. The space after = is mandatory for all sc create parameters.

sc create MySvc binPath= "C:\Tools\myservice.exe" start= auto DisplayName= "My Background Service"

Output:

[SC] CreateService SUCCESS

Verify:

sc qc MySvc

Output:

[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: MySvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        BINARY_PATH_NAME   : C:\Tools\myservice.exe
        DISPLAY_NAME       : My Background Service
        SERVICE_START_NAME : LocalSystem

Configuring failure recovery actions

sc failure sets what the SCM does when a service exits with a non-zero code. Actions are restart, run (run a command), or reboot. Specify up to three actions (first, second, subsequent failures) and a reset period.

sc failure MySvc reset= 86400 actions= restart/5000/restart/10000/restart/30000

Output:

[SC] ChangeServiceConfig2 SUCCESS

Deleting a service

sc delete removes the service entry from the SCM registry. If the service is running, stop it first — the delete is deferred until the service stops.

sc stop MySvc
sc delete MySvc

Output:

[SC] ControlService FAILED 1062:

The service has not been started.

[SC] DeleteService SUCCESS

Common pitfalls

1. Space after = is mandatory — sc config Spooler start=auto (no space) fails silently or with a cryptic error; always write start= auto.
2. sc in PowerShell is Set-Content — always type sc.exe in a PowerShell session to invoke the service tool, not the alias.
3. Delete is deferred for running services — sc delete on a running service returns SUCCESS but the entry persists until the service stops (visible as MARKED_FOR_DELETION in query output).
4. sc start may time out — if a service takes longer than 30 seconds to start, sc reports an error even if the service continues starting; use sc query in a loop to poll.
5. Remote operations need \\server — sc \\fileserver01 query Spooler targets a remote SCM; requires appropriate permissions and firewall rules (RPC port 445/135).

Real-world recipes

Restart a hung service

sc stop Spooler && sc start Spooler

Output:

SERVICE_NAME: Spooler
        STATE              : 3  STOP_PENDING
...
SERVICE_NAME: Spooler
        STATE              : 2  START_PENDING

Disable all non-essential services matching a pattern

for /f "tokens=2" %S in ('sc query state= all ^| findstr "SERVICE_NAME" ^| findstr /I "update"') do (
    sc config %S start= disabled
    echo Disabled: %S
)

Output:

[SC] ChangeServiceConfig SUCCESS
Disabled: AdobeARMservice
[SC] ChangeServiceConfig SUCCESS
Disabled: GoogleUpdateService

Install and start a service in one shot

@echo off
sc create DataCollector binPath= "C:\Services\collector.exe -config C:\Config\dc.ini" ^
    start= delayed-auto ^
    DisplayName= "Data Collector Service" ^
    obj= "NT AUTHORITY\NetworkService"
sc description DataCollector "Collects telemetry data and forwards to central server"
sc start DataCollector
echo DataCollector service installed and started.

Output:

[SC] CreateService SUCCESS
[SC] ChangeServiceConfig2 SUCCESS
[SC] StartService FAILED 1053:

The service did not respond to the start or control request in a timely fashion.

Service state machine

A Windows service moves between a small set of discrete states maintained by the SCM. Every sc query shows the current state; every sc start/stop/pause/continue requests a transition. Understanding the state machine is the difference between scripts that work most of the time and scripts that survive a slow host.

sc query does not block on transitions — it returns whatever the SCM reports right now. If you stop a service and need to wait for it to finish, you must poll:

@echo off
sc stop Spooler >nul
:wait
for /f "tokens=4" %%S in ('sc query Spooler ^| findstr "STATE"') do set STATE=%%S
if /I "%STATE%"=="STOPPED" goto done
timeout /t 1 /nobreak >nul
goto wait
:done
echo Spooler stopped

Output:

Spooler stopped

In PowerShell the equivalent is one line because Stop-Service blocks until the target state is reached or a timeout elapses:

Stop-Service Spooler -Force
(Get-Service Spooler).Status

Output:

Stopped

Start types: when each one fires

sc config start= accepts six values, each mapped to a different point in the boot/login sequence. Choose by when the service must be available; choose disabled if you want the service entry to remain configurable but never run.

rem View the current start type
sc qc wuauserv | findstr START_TYPE

Output:

        START_TYPE         : 3   DEMAND_START

rem Delayed-auto is the default for many telemetry services in Windows 10/11
sc config Diagsvc start= delayed-auto
sc qc Diagsvc | findstr START_TYPE

Output:

[SC] ChangeServiceConfig SUCCESS
        START_TYPE         : 2   AUTO_START  (DELAYED)

Delayed-auto is the right choice for non-critical background work — it lets the user log on faster because the service waits until interactive responsiveness is established. Don't use it for services that other services depend on at boot.

Service account choice (obj=)

obj= selects the security context the service runs under. The four built-in accounts trade off privilege against credential management; using a domain user is supported but locks you into Active Directory and explicit password handling.

sc config MySvc obj= "NT AUTHORITY\NetworkService"

Output:

[SC] ChangeServiceConfig SUCCESS

For a domain user you must supply the password; for the four built-ins, omit password=:

sc config MySvc obj= "MYDOMAIN\svc_myapp" password= "S3cr3t!"

Output:

[SC] ChangeServiceConfig SUCCESS

The credential is stored in the LSA secret store; subsequent sc qc shows the account but never the password.

Virtual service accounts (NT SERVICE\MySvc) are preferred over domain accounts for new services since Server 2008 R2 — the OS manages the password for you, the account has a per-service SID for ACLs, and there's no rotation work.

Dependencies

Services can declare hard dependencies — service A will not start until service B is RUNNING, and stopping B will not be permitted while A depends on it. The dependency list is set at create-time with depend= or modified later with sc config depend=.

rem Make MySvc depend on RPC and the Event Log
sc config MySvc depend= RpcSs/EventLog

Output:

[SC] ChangeServiceConfig SUCCESS

rem Show services that depend on a target
sc enumdepend Spooler

Output:

SERVICE_NAME: Fax
DISPLAY_NAME: Fax
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 1   STOPPED
        ...

Forward dependencies (what this service needs) are in the DEPENDENCIES line of sc qc. Reverse dependencies (what needs this service) come from sc enumdepend. Both directions matter when scripting service shutdowns — stopping a dependency without first stopping its dependents may leave the dependents in an unhealthy state.

Failure recovery in depth

sc failure configures up to three sequential recovery actions plus a reset window. Each action is one of restart (just restart the service), run (run an arbitrary command), or reboot (reboot the machine — use with extreme care). Delays are in milliseconds.

sc failure MySvc reset= 86400 actions= restart/5000/restart/30000/run/0 ^
    command= "C:\Scripts\notify_failure.bat" rebootmsg= ""

Output:

[SC] ChangeServiceConfig2 SUCCESS

Decode of the above: on the first failure restart after 5 s; on the second failure restart after 30 s; on the third and subsequent failures run notify_failure.bat immediately; the failure counter resets 24 hours after a successful run.

sc qfailure MySvc

Output:

SERVICE_NAME: MySvc
        RESET_PERIOD (in seconds)    : 86400
        REBOOT_MESSAGE               :
        COMMAND_LINE                 : C:\Scripts\notify_failure.bat

        FAILURE_ACTIONS              :
              RESTART -- Delay = 5000 milliseconds.
              RESTART -- Delay = 30000 milliseconds.
              RUN PROCESS -- Delay = 0 milliseconds.

Set failureflag= 1 to make the recovery actions fire even on a clean service exit (exit code 0) — by default they only fire on a crash:

sc failureflag MySvc 1

Output:

[SC] ChangeServiceConfig2 SUCCESS

Service triggers

Since Windows 7/Server 2008 R2 services can be triggered by events rather than only by auto/demand. Examples: a USB device class arriving, a firewall port opening, a domain join completing. Triggers are managed with sc triggerinfo.

rem View triggers
sc qtriggerinfo wuauserv

Output:

SERVICE_NAME: wuauserv

        START SERVICE
          DOMAIN JOINED STATUS         : 1ce20aba-9851-4421-9430-1ddeb766e809 [DOMAIN_JOINED]

rem Start MySvc whenever a particular ETW provider raises an event
sc triggerinfo MySvc start/strcustom/{c8e6e6b9-...}/MyEvent

Output:

[SC] ChangeServiceConfig2 SUCCESS

Triggers are how modern Windows replaces "always-on" services with "starts when needed" services — saving memory and battery. Authoring a new service? Investigate triggers before you choose start= auto.

PowerShell equivalents

PowerShell ships two parallel APIs for services: the legacy *-Service cmdlets (Get-Service, Start-Service, Stop-Service, Restart-Service, Set-Service, New-Service, Remove-Service) which speak directly to the SCM, and the broader CIM-based Get-CimInstance Win32_Service / Win32_BaseService which exposes every property sc qc shows plus a few more (process ID, dependencies, account SID).

Direct equivalents

Get-Service basics

Get-Service -Name w*

Output:

Status   Name               DisplayName
------   ----               -----------
Running  W32Time            Windows Time
Stopped  WalletService      WalletService
Running  WinRM              Windows Remote Management (WS-Management)
Running  wuauserv           Windows Update

Get-Service | Where-Object Status -eq 'Stopped' | Where-Object StartType -eq 'Automatic'

Output:

Status   Name               DisplayName
------   ----               -----------
Stopped  gpsvc              Group Policy Client
Stopped  Diagsvc            Diagnostic Execution Service

That second query — services that should be running but aren't — is one of the most useful health checks; it has no concise sc equivalent.

Set-Service edge cases

Set-Service -StartupType AutomaticDelayedStart is PowerShell 6+ only. On Windows PowerShell 5.1 the cmdlet doesn't accept that value; you must shell out to sc.exe:

sc.exe config Diagsvc start= delayed-auto

Output:

[SC] ChangeServiceConfig SUCCESS

Similarly, Remove-Service and Set-Service -Description only exist in PowerShell 6+. Locked-down Windows Server 2019 hosts that lack PS7 still need sc.exe for these operations.

CIM/WMI bridge

For property-rich queries that Get-Service doesn't surface (state vs status, PID, dependencies, account), use CIM:

Get-CimInstance Win32_Service -Filter "Name='Spooler'" |
    Select-Object Name, State, StartMode, ProcessId, StartName,
        @{N='Path';E={$_.PathName}}, Description

Output:

Name        : Spooler
State       : Running
StartMode   : Auto
ProcessId   : 1648
StartName   : LocalSystem
Path        : C:\Windows\System32\spoolsv.exe
Description : This service spools print jobs and handles interaction with the printer. …

Get-WmiObject Win32_Service returns the same data but is deprecated and absent from PowerShell 7+. Always use Get-CimInstance in new scripts — same property names, same filter syntax, just Cim instead of Wmi.

Invoking methods via CIM

Invoke-CimMethod -ClassName Win32_Service -MethodName Create -Arguments @{
    Name             = 'MySvc'
    DisplayName      = 'My Background Service'
    PathName         = 'C:\Tools\myservice.exe'
    ServiceType      = [byte]16   # OWN_PROCESS
    StartMode        = 'Automatic'
    DesktopInteract  = $false
    ErrorControl     = [byte]1
    StartName        = 'LocalSystem'
}

Output:

ReturnValue PSComputerName
----------- --------------
          0

Return value 0 is success; full list at the Microsoft Win32_Service.Create docs. This is the only fully-native PowerShell path that doesn't shell out to sc.exe for the parameters Set-Service can't reach.

Service vs scheduled task: which to use

When you need a long-running background workload, you have two infrastructure choices: a Windows service or a scheduled task. They overlap but optimise for different things.

See the schtasks deep-dive for the other side of this trade-off.

Service vs Sysinternals PsService

Sysinternals' psservice (see the Sysinternals deep-dive) is a near-drop-in for sc query with two upgrades worth knowing about: it shows the display name in addition to the service name in the default output, and its find verb searches by display name substring across all services on the host — something sc can only do via findstr post-filtering.

psservice -accepteula find "update"

Output:

Searching for service 'update'...

SERVICE_NAME: wuauserv
DISPLAY_NAME: Windows Update
        TYPE              : 20  WIN32_SHARE_PROCESS
        STATE             : 4  RUNNING
        ...

For interactive exploration psservice is friendlier; for scripts sc is preferred because output parsing is consistent across Windows versions.

Cross-platform: sc vs systemctl

For Linux muscle memory, sc maps onto systemctl (and historically SysV service). The mapping is close but not perfect — systemd has unit types (service, socket, timer, mount, target) that have no Windows equivalent, and Windows has start triggers and failure recovery codified in the SCM that systemd implements with unit files.

Common pitfalls — extended

In addition to the basics above:

6. sc create doesn't check that binPath= exists. You can create a service pointing at any path — the failure shows up only at sc start. Always verify the file exists before creating.
7. obj= with no password= for a non-built-in account silently uses an empty password. Then start fails with 1069 ("logon failure"). Pass password= "" explicitly only for the built-in LocalSystem/NetworkService/LocalService accounts.
8. sc.exe exit code is 0 even when the service is in STOP_PENDING. A "successful" sc stop may not actually have stopped the service — poll with sc query if you need certainty.
9. sc config DisplayName= is per-token-sensitive. If your display name has an = sign you'll need to wrap it carefully because sc parses the first = as the delimiter.
10. Service marked for deletion blocks re-create. If sc delete returned SUCCESS but the service is still running, the SCM marks it for deletion. sc create with the same name fails with 1072 until the service actually stops.
11. PowerShell aliases shadow sc. sc Hello in PowerShell calls Set-Content, not the SCM tool — always type sc.exe in PowerShell, never just sc.

Diagnostic recipes

Find which process owns a given service

sc queryex Spooler | findstr PID

Output:

        PID                : 1648

rem Confirm with tasklist
tasklist /fi "PID eq 1648"

Output:

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
spoolsv.exe                   1648 Services                   0     12,408 K

Find all services hosted in a single svchost

tasklist /svc /fi "PID eq 2340"

Output:

Image Name                     PID Services
========================= ======== ============================================
svchost.exe                   2340 wuauserv

Export full service inventory for change tracking

Get-CimInstance Win32_Service |
    Select-Object Name, DisplayName, State, StartMode, StartName, PathName, Description |
    Export-Csv -NoTypeInformation -Path "C:\Audit\svc_$env:COMPUTERNAME.csv"

Output: (none — written to C:\Audit\svc_MYHOST.csv)

Bulk disable a category of services

Get-Service | Where-Object DisplayName -like '*Telemetry*' |
    Set-Service -StartupType Disabled -PassThru |
    ForEach-Object { Stop-Service $_.Name -Force -ErrorAction SilentlyContinue }

Output:

Status   Name               DisplayName
------   ----               -----------
Stopped  DiagTrack          Connected User Experiences and Telemetry
Stopped  dmwappushservice   Device Management Wireless Application Protocol …

Wait for a dependent service to stop before restarting its parent

function Restart-WithDependents {
    param([string]$Name)
    $deps = Get-Service $Name -DependentServices |
        Where-Object Status -eq 'Running'
    foreach ($d in $deps) { Stop-Service $d.Name -Force }
    Restart-Service $Name -Force
    foreach ($d in $deps) { Start-Service $d.Name }
}
Restart-WithDependents -Name RpcSs

Output: (none on success — all dependents stop, RPCSS restarts, dependents come back)

Find services that exited abnormally in the last 24 h

Get-WinEvent -FilterHashtable @{
    LogName    = 'System'
    ProviderName = 'Service Control Manager'
    Id         = 7034,7031
    StartTime  = (Get-Date).AddDays(-1)
} | Select-Object TimeCreated, Id, Message

Output:

TimeCreated                   Id Message
-----------                   -- -------
5/24/2026 3:14:22 PM        7034 The MySvc service terminated unexpectedly. …
5/24/2026 8:02:11 AM        7031 The Spooler service terminated unexpectedly. …

Windows Server 2025 / Windows 11 24H2 notes

sc.exe itself is unchanged in Windows Server 2025 and Windows 11 24H2/25H2 — the same verbs, the same key= value quirks, the same exit codes. Two adjacent platform changes affect day-to-day service work though:

• Credential Guard is enabled by default on Server 2025 for systems that meet the hardware requirements. Services running under a domain user account on those hosts can no longer decrypt cached credentials via LSASS injection, so legacy services that rely on LSA secret extraction (and many third-party PAM agents) need migration to gMSA — sc config <svc> obj= "DOMAIN\svc_account$" password= "".
• gMSA password rotation is now stable for the System Center Orchestrator 2025 path, which is the canonical "let LSA manage the password for me" account model. Combined with sc config obj= ...$, this removes manual password rotation from service onboarding.

Neither change requires sc.exe syntax updates — they're orchestration considerations to flag when migrating services to current Windows.

See also

• tasklist — List Running Processes — correlate service PIDs (from sc queryex) with process detail.
• taskkill — Terminate Processes — last-resort path when a service refuses to stop.
• schtasks — Task Scheduler CLI — the other long-running-workload primitive on Windows.
• Sysinternals — PsExec, Handle, ProcMon and the Sysadmin Toolkit — psservice for richer interactive queries.
• wmic — Windows Management Instrumentation CLI — legacy CIM access; now superseded by Get-CimInstance.

Sources

learn.microsoft.com — sc.exe create · learn.microsoft.com — What's new in Windows Server 2025 · learn.microsoft.com — Get-Service