sc (與服務(wù)控制管理器和服務(wù)進(jìn)行通信的命令行程序)

小豬老師發(fā)表于 2020-06-24 18:23

瀏覽次數(shù)：

命令行 MSDOS命令 sc

在手機(jī)上閱讀

釋放雙眼，帶上耳機(jī)，聽(tīng)聽(tīng)看~！

00:00

SC是用于與服務(wù)和服務(wù)控制管理器進(jìn)行通信的命令行程序。

查看英文版

1 sc 運(yùn)行系統(tǒng)環(huán)境

2 sc 語(yǔ)法

3 sc 示例

sc 運(yùn)行系統(tǒng)環(huán)境

Windows vista

Windows 7

Windows 8

Windows 10

sc 語(yǔ)法

sc[command] [service name]...

選項(xiàng)的格式為“ \\ ServerName”

指令

queryex

查詢服務(wù)的擴(kuò)展?fàn)顟B(tài)，或枚舉服務(wù)類型的狀態(tài)。

start

啟動(dòng)服務(wù)。用法： sc <服務(wù)器>start[服務(wù)名稱]...

pause

將暫停控制請(qǐng)求發(fā)送到服務(wù)。用法： sc <服務(wù)器>pause[服務(wù)名稱]

interrogate

將INTERROGATE控制請(qǐng)求發(fā)送到服務(wù)。用法： sc <服務(wù)器>interrogate[服務(wù)名稱]

continue

將CONTINUE控制請(qǐng)求發(fā)送到服務(wù)。用法： sc <服務(wù)器>continue[服務(wù)名稱]

stop

向服務(wù)發(fā)送一個(gè)STOP請(qǐng)求。

用法：

sc <服務(wù)器>STOP[服務(wù)名稱]>
=服務(wù)停止的可選原因代碼號(hào)，由以下元素組成，格式為：

標(biāo)志：主要原因：次要原因

[例如1：2：8表示硬件：磁盤（計(jì)劃外）]

標(biāo)記
------------------
1-計(jì)劃外
2-自定義
4-計(jì)劃中

主要原因
------------------
1-其他
2-硬件
3-操作系統(tǒng)
4-軟件
5-應(yīng)用程序
64-255-自定義

次要原因
------------------
1-其他
2-維護(hù)
3-安裝
4-升級(jí)
5-重新配置
6-掛起
7-不穩(wěn)定
8-磁盤
9-網(wǎng)卡
10-環(huán)境
11-硬件驅(qū)動(dòng)程序
12-其他驅(qū)動(dòng)程序
13-Service Pack
14-軟件更新
15-安全修復(fù)
16-安全
17-網(wǎng)絡(luò)連接
18-WMI
19-Service Pack卸載
20-軟件更新卸載
22-安全修復(fù)程序卸載
23-MMC
256 -65535-Custom

< comment >=出于上述原因的可選注釋（最多127個(gè)字符）

config

更改服務(wù)的配置（永久）。
用法：
sc <服務(wù)器>config[服務(wù)名稱] <選項(xiàng)1> <選項(xiàng)2> ..

type=	< own\|share\|interact\|kernel\|filesys\|rec\|adapt\|userown\|usershare >
start=	< boot\|system\|auto\|demand\|disabled\|delayed-auto >
error=	< normal\|severe\|critical\|ignore >
binPath=	< BinaryPathName to the .exe file >
group=	< LoadOrderGroup >
tag=	< yes\|no >
depend=	< Dependencies(separated by / (forward slash)) >
obj=	< AccountName\|ObjectName >
DisplayName=	< display name >
password=	< password >

description

更改服務(wù)的描述。

用法：

sc <服務(wù)器>description[服務(wù)名稱] [description]

failure

更改服務(wù)在失敗時(shí)采取的措施。

用法：

sc <服務(wù)器>failure[服務(wù)名稱] <選項(xiàng)1> <選項(xiàng)2> ... 選項(xiàng)：

reset=	<無(wú)故障的時(shí)間長(zhǎng)度（以秒為單位），之后將故障計(jì)數(shù)重置為0（可能是INFINITE）> （必須與action =結(jié)合使用）
reboot=	< 失敗后重新啟動(dòng)之前廣播的消息 >
command=	<失敗時(shí)要運(yùn)行的命令行>
actions=	<失敗操作及其延遲時(shí)間（以毫秒為單位），以/（正斜杠）分隔-例如，run / 5000 / reboot / 800 有效操作為> （必須與reset結(jié)合使用=選項(xiàng)）

failureflag

更改服務(wù)的失敗操作標(biāo)志設(shè)置。如果此設(shè)置為0（默認(rèn)值），則僅當(dāng)服務(wù)進(jìn)程在服務(wù)處于SERVICE_STOPPED以外的狀態(tài)下終止時(shí)，

SCM（服務(wù)控制管理器）才會(huì)對(duì)服務(wù)啟用已配置的失敗操作。

如果此設(shè)置為1，則除了上述服務(wù)進(jìn)程終止之外，如果服務(wù)進(jìn)入帶有非0的Win32退出代碼的SERVICE_STOPPED狀態(tài)，

則SCM會(huì)對(duì)服務(wù)啟用已配置的失敗操作。

如果服務(wù)未配置任何失敗操作，則將忽略此設(shè)置。

用法：

sc <服務(wù)器> failureflag [服務(wù)名稱] [flag]

sidtype

更改服務(wù)的SID（服務(wù)安全標(biāo)識(shí)符）類型設(shè)置。如果此設(shè)置為“ unrestricted”，則由于該進(jìn)程中的第一個(gè)服務(wù)正在啟動(dòng)，

因此當(dāng)下一次啟動(dòng)該服務(wù)進(jìn)程時(shí)，SCM將將該服務(wù)的SID添加到該服務(wù)進(jìn)程令牌中。此設(shè)置僅對(duì)Win32用戶模式服務(wù)有效。

如果此設(shè)置為“ restricted”，則由于該進(jìn)程中的第一個(gè)服務(wù)正在啟動(dòng)，因此下次啟動(dòng)該服務(wù)進(jìn)程時(shí)，SCM將將該服務(wù)的SID添加到該服務(wù)進(jìn)程令牌中。

同樣，此服務(wù)的SID將添加到流程令牌中的限制SID列表中。流程令牌將是受限令牌。有關(guān)受限制令牌的詳細(xì)信息，請(qǐng)參見(jiàn)MSDN。

此設(shè)置僅對(duì)Win32用戶模式服務(wù)有效。同樣，對(duì)于共享流程服務(wù)，在流程中共同托管的所有服務(wù)都必須設(shè)置此SID類型才能生效。

如果此設(shè)置為“ none”，則SCM不會(huì)將服務(wù)的SID添加到服務(wù)進(jìn)程令牌中。

用法：

sc <服務(wù)器> sidtype [服務(wù)名稱] [類型] 選項(xiàng)：

type	< none\|unrestricted\|restricted >

privs

更改服務(wù)的所需特權(quán)設(shè)置。由于服務(wù)進(jìn)程中的第一個(gè)服務(wù)正在啟動(dòng)，因此特權(quán)設(shè)置在服務(wù)進(jìn)程啟動(dòng)時(shí)生效。

那時(shí)，SCM（服務(wù)控制管理器）計(jì)算將在同一流程中托管的所有服務(wù)所需的所有特權(quán)的并集，然后使用這些特權(quán)創(chuàng)建流程。

缺少此設(shè)置將意味著該服務(wù)需要安全子系統(tǒng)允許該服務(wù)在配置的帳戶中運(yùn)行的進(jìn)程的所有特權(quán)。

用法：

sc <服務(wù)器>privs[服務(wù)名稱] [privileges] 選項(xiàng)

privileges

< privileges(separated by="" (forward="" slash))="" >
[ E.g., SeBackupPrivilege/SeRestorePrivilege]

managedaccount

更改運(yùn)行服務(wù)的帳戶是否使用托管密碼。如果此設(shè)置為“ true”，則SCM將在啟動(dòng)服務(wù)時(shí)向NetLogon請(qǐng)求帳戶密碼。

如果此設(shè)置為“ false”，則SCM將使用配置的帳戶密碼。

用法：

sc <服務(wù)器>managedaccount [服務(wù)名稱] [type]

type	< true\|false >

查詢服務(wù)的配置信息。

用法：

sc <服務(wù)器> qc [服務(wù)名稱]

qdescription

查詢服務(wù)描述。

用法：

sc <服務(wù)器> qdescription [服務(wù)名稱]

qfailure

查詢服務(wù)在失敗時(shí)采取的措施。

用法：

sc <服務(wù)器> qfailure [服務(wù)名稱]

qfailureflag

檢索服務(wù)的失敗操作標(biāo)志設(shè)置。如果此設(shè)置為0（默認(rèn)值），則僅當(dāng)服務(wù)進(jìn)程在服務(wù)處于SERVICE_STOPPED以外的狀態(tài)下終止時(shí)，

SCM（服務(wù)控制管理器）才會(huì)對(duì)服務(wù)啟用已配置的失敗操作。如果此設(shè)置為1，則除了上述服務(wù)進(jìn)程終止之外，

如果服務(wù)進(jìn)入帶有非0的Win32退出代碼的SERVICE_STOPPED狀態(tài)，則SCM會(huì)對(duì)服務(wù)啟用已配置的失敗操作。

如果服務(wù)未配置任何失敗操作，則將忽略此設(shè)置。

用法：

sc <服務(wù)器> qfailureflag [服務(wù)名稱]

qsidtype

查詢服務(wù)的SID（服務(wù)安全標(biāo)識(shí)符）類型設(shè)置。如果此設(shè)置為“ unrestricted”，則由于下一次啟動(dòng)服務(wù)中的第一個(gè)服務(wù)，

SCM（服務(wù)控制管理器）將在下次啟動(dòng)服務(wù)過(guò)程時(shí)將該服務(wù)的SID添加到服務(wù)過(guò)程令牌中。

此設(shè)置僅對(duì)Win32用戶模式服務(wù)有效。如果此設(shè)置為“ restricted”，則由于該進(jìn)程中的第一個(gè)服務(wù)正在啟動(dòng)，因此下次啟動(dòng)該服務(wù)進(jìn)程時(shí)，

SCM將將該服務(wù)的SID添加到該服務(wù)進(jìn)程令牌中。同樣，此服務(wù)的SID將添加到流程令牌中的限制SID列表中。

流程令牌將是受限令牌。有關(guān)受限制令牌的詳細(xì)信息，請(qǐng)參見(jiàn)MSDN。此設(shè)置僅對(duì)Win32用戶模式服務(wù)有效。

同樣，對(duì)于共享流程服務(wù)，在流程中共同托管的所有服務(wù)都必須設(shè)置此SID類型才能生效。

如果此設(shè)置為“ none”，則SCM不會(huì)將服務(wù)的SID添加到服務(wù)進(jìn)程令牌中。

用法：

sc <服務(wù)器> qsidtype [服務(wù)名稱]

qprivs

查詢服務(wù)所需的特權(quán)設(shè)置。由于服務(wù)進(jìn)程中的第一個(gè)服務(wù)正在啟動(dòng)，因此特權(quán)設(shè)置在服務(wù)進(jìn)程啟動(dòng)時(shí)生效。

那時(shí)，SCM計(jì)算將在同一進(jìn)程中托管的所有服務(wù)所需的所有特權(quán)的并集，然后使用這些特權(quán)創(chuàng)建進(jìn)程。

如果沒(méi)有此設(shè)置，則表示該服務(wù)需要安全子系統(tǒng)允許在該服務(wù)的已配置帳戶中運(yùn)行的進(jìn)程的所有特權(quán)。

用法：

sc <服務(wù)器> qprivs [服務(wù)名稱]

qtriggerinfo

查詢服務(wù)的觸發(fā)參數(shù)。

用法：

sc <服務(wù)器> qtriggerinfo [服務(wù)名稱]

qpreferrednode

查詢Win32服務(wù)的首選NUMA節(jié)點(diǎn)。此設(shè)置僅對(duì)其自己的過(guò)程服務(wù)有效。如果服務(wù)沒(méi)有首選節(jié)點(diǎn)設(shè)置，則查詢將失敗。

用法：

sc <服務(wù)器> qpreferrednode [服務(wù)名稱]

qmanagedaccount

查詢服務(wù)是否使用具有LSA管理的密碼的帳戶。

用法：

sc <服務(wù)器> qmanagedaccount [服務(wù)名稱]

qprotection

查詢服務(wù)是否標(biāo)記為在受保護(hù)的進(jìn)程中啟動(dòng)。請(qǐng)注意，此設(shè)置無(wú)法更改。

用法：

sc <服務(wù)器> qprotection [服務(wù)名稱]

quserservice

Q從指定的用戶服務(wù)模板創(chuàng)建的同一會(huì)話中，當(dāng)前用戶的用戶服務(wù)實(shí)例查詢。

用法：

sc quserservice <服務(wù)模板名稱>

delete

從注冊(cè)表中刪除服務(wù)條目。如果該服務(wù)正在運(yùn)行，或者另一個(gè)進(jìn)程對(duì)該服務(wù)具有打開(kāi)的句柄，則該服務(wù)將標(biāo)記為刪除。

用法：

sc <服務(wù)器>delete[服務(wù)名稱]

create

在注冊(cè)表和服務(wù)數(shù)據(jù)庫(kù)中創(chuàng)建服務(wù)條目。

用法：

sc <服務(wù)器>create[服務(wù)名稱] [binPath =] <選項(xiàng)1> <選項(xiàng)2> ... 選項(xiàng)：

type=	< own \| share \| interact \| kernel \| filesys \| rec \| userown \| usershare > （默認(rèn)=擁有）
start=	< boot \| system \| auto \| demand \| disabled \| delayed-auto > （默認(rèn)=需求）
error=	< normal\|severe\|critical\|ignore > (default = normal)< /normal\|severe\|critical\|ignore >
binPath=	< BinaryPathName to the .exe file >
group=	< LoadOrderGroup >
tag=	< yes\|no >
depend=	< Dependencies(separated by / (forward slash)) >
obj=	< AccountName\|ObjectName > (default = LocalSystem)
DisplayName=	< display name >
password=	< password >

control

將控件發(fā)送到服務(wù)。

用法：

sc <服務(wù)器>控件[服務(wù)名稱] <值> <值> =用戶定義的控制代碼

<值> = < 參數(shù)更改| netbindadd | netbindremove | netbindenable | netbinddisable >

sdshow

顯示服務(wù)的安全描述符。

用法：

sc <服務(wù)器> sdshow <服務(wù)名稱> < showrights >

sdset

設(shè)置服務(wù)的安全描述符。

用途：

sc <服務(wù)器> sdset <服務(wù)名稱>

showsid

顯示與任意名稱相對(duì)應(yīng)的服務(wù)SID字符串。

該名稱可以是現(xiàn)有或不存在的服務(wù)的名稱。

用法：

sc showsid [名稱]

triggerinfo

配置服務(wù)的觸發(fā)參數(shù)。

用法：

sc <服務(wù)器> triggerinfo [服務(wù)名稱] <選項(xiàng)1> <選項(xiàng)2> ...

選項(xiàng)：

start/device/UUID/HwId1/...	<在具有一個(gè)或多個(gè)硬件ID字符串或兼容ID字符串的指定設(shè)備接口類UUID 字符串到達(dá)時(shí)啟動(dòng)服務(wù)>
start/custom/UUID/data0/..	<在到達(dá)指定的自定義ETW提供程序UUID字符串的事件時(shí)啟動(dòng)服務(wù)，該字符串帶有一個(gè)或多個(gè)十六進(jìn)制字符串格式的二進(jìn)制數(shù)據(jù)項(xiàng)，例如ABCDABCD以設(shè)置4字節(jié)數(shù)據(jù)>
stop/custom/UUID/data0/...	<當(dāng)事件從指定的自定義ETW提供程序UUID字符串到達(dá)時(shí)停止服務(wù)，該事件帶有一個(gè)或多個(gè)十六進(jìn)制字符串格式的二進(jìn)制數(shù)據(jù)項(xiàng)（例如ABCDABCD）以設(shè)置4字節(jié)數(shù)據(jù)>
start/strcustom/UUID/data0/..	<從具有一個(gè)或多個(gè)可選字符串?dāng)?shù)據(jù)項(xiàng)的指定自定義ETW提供程序UUID字符串到達(dá)事件時(shí)啟動(dòng)服務(wù)>
stop/strcustom/UUID/data0/..	<在事件到達(dá)指定的自定義ETW提供者UUID字符串以及一個(gè)或多個(gè)可選字符串?dāng)?shù)據(jù)項(xiàng)后停止服務(wù)>
start/lvlcustom/UUID/data0/..	<當(dāng)事件到達(dá)指定的自定義ETW提供者UUID字符串時(shí)，啟動(dòng)服務(wù)，該字符串的級(jí)別高于或等于十六進(jìn)制數(shù)字格式的數(shù)據(jù)項(xiàng)，例如0x01>
stop/lvlcustom/UUID/data0/..	<當(dāng)事件到達(dá)指定的自定義ETW提供者UUID字符串時(shí)，停止服務(wù)，該字符串的級(jí)別高于或等于十六進(jìn)制數(shù)字格式的數(shù)據(jù)項(xiàng)，例如0x01>
start/kwanycustom/UUID/data0/..	<在到達(dá)指定的自定義ETW提供程序UUID字符串的事件后，使用與十六進(jìn)制數(shù)字格式（例如0x0A03）的數(shù)據(jù)項(xiàng)中的任何位匹配的關(guān)鍵字來(lái)啟動(dòng)服務(wù)>
stop/kwanycustom/UUID/data0/..	<使用指定的關(guān)鍵字與十六進(jìn)制數(shù)字格式（例如0x0A03）匹配數(shù)據(jù)項(xiàng)中任何位的關(guān)鍵字，停止從指定的自定義ETW提供程序UUID字符串到達(dá)事件的服務(wù)>
start/kwallcustom/UUID/data0/..	<在到達(dá)指定的自定義ETW提供者UUID字符串的事件后，使用與十六進(jìn)制數(shù)字格式（如0x0A03）匹配數(shù)據(jù)項(xiàng)中所有位的關(guān)鍵字啟動(dòng)服務(wù)>
stop/kwallcustom/UUID/data0/..	<使用來(lái)自指定自定義ETW提供程序UUID字符串的事件停止服務(wù)，該關(guān)鍵字使用與十六進(jìn)制數(shù)字格式（如0x0A03）匹配數(shù)據(jù)項(xiàng)中所有位的關(guān)鍵字>
start/networkon	<在第一個(gè)IP地址上啟動(dòng)服務(wù)>
stop/networkoff	<在零IP地址上停止服務(wù)>
start/domainjoin	<啟動(dòng)域加入服務(wù)>
stop/domainleave	<在域休假時(shí)停止服務(wù)>
start/portopen/parameter	<在打開(kāi)網(wǎng)絡(luò)端口時(shí)啟動(dòng)服務(wù)。該參數(shù)以分號(hào)分隔，形式為portnumber; protocolname; imagepath;服務(wù)名稱>
stop/portclose/parameter	<在關(guān)閉網(wǎng)絡(luò)端口后停止服務(wù)。該參數(shù)以分號(hào)分隔，形式為portnumber; protocolname; imagepath;服務(wù)名稱>
start/machinepolicy	<當(dāng)計(jì)算機(jī)組策略更改或啟動(dòng)時(shí)存在時(shí)啟動(dòng)服務(wù)>
start/userpolicy	<當(dāng)用戶組策略更改或啟動(dòng)時(shí)存在時(shí)啟動(dòng)服務(wù)>
start/rpcinterface/UUID	<當(dāng)請(qǐng)求到達(dá)給定接口的RPC端點(diǎn)映射器時(shí)啟動(dòng)服務(wù)>
start/namedpipe/pipename	<當(dāng)?shù)竭_(dá)指定命名管道的請(qǐng)求時(shí)啟動(dòng)服務(wù)。不要在管道名稱中包含"\\.\pipe\"部分
delete	<刪除現(xiàn)有的觸發(fā)參數(shù)>

preferrednode

更改Win32服務(wù)的首選NUMA節(jié)點(diǎn)。此設(shè)置僅對(duì)其自己的過(guò)程服務(wù)有效。要?jiǎng)h除現(xiàn)有設(shè)置，請(qǐng)將節(jié)點(diǎn)號(hào)設(shè)置為-1。

如果提供了無(wú)效的首選節(jié)點(diǎn)號(hào)，則更改請(qǐng)求將失敗。

用法：

sc <服務(wù)器> preferrednode [服務(wù)名稱] [節(jié)點(diǎn)號(hào)]

GetDisplayName

獲取服務(wù)的DisplayName。

用法：

sc <服務(wù)器> GetDisplayName <服務(wù)密鑰名稱> <緩沖區(qū)大小>

GetKeyName

使用顯示名稱作為輸入，獲取與特定服務(wù)關(guān)聯(lián)的密鑰名稱。

用法：

scGetKeyName <服務(wù)顯示名稱>

EnumDepend

枚舉服務(wù)依賴項(xiàng)。

用法：

sc <服務(wù)器> EnumDepend <服務(wù)名稱> <緩沖區(qū)大小>

以下命令不需要服務(wù)名稱：
sc< server > < command > < option >

boot	(ok \| bad) 指示是否應(yīng)將上次引導(dǎo)保存為最近一次的良好引導(dǎo)配置
Lock	鎖定服務(wù)數(shù)據(jù)庫(kù)
QueryLock	查詢SCManager數(shù)據(jù)庫(kù)的LockStatus

QUERY和QUERYEX選項(xiàng)

如果在查詢命令后跟服務(wù)名稱，則返回該服務(wù)的狀態(tài)。在這種情況下，其他選項(xiàng)不適用。如果query命令后面沒(méi)有任何內(nèi)容或下面列出的選項(xiàng)之一，則將枚舉服務(wù)。

type=	要枚舉的服務(wù)類型 (driver, service, userservice, all) (默認(rèn)值= service)
state=	要枚舉的服務(wù)狀態(tài) (inactive, all) (默認(rèn)值 = active)
bufsize=	枚舉緩沖區(qū)的大小（以字節(jié)為單位）（默認(rèn)= 4096）
ri=	開(kāi)始枚舉的恢復(fù)索引號(hào) （默認(rèn)= 0）
group=	要枚舉的服務(wù)組（默認(rèn)=all groups）

sc[command] [service name]...

The optionhas the form "\\ServerName"

Commands

queryex

Queries the extended status for a service, or enumerates the status for types of services.

start

Starts a service. Usage: scstart [service name]...

pause

Sends a PAUSE control request to a service. Usage: scpause [service name]

interrogate

Sends an INTERROGATE control request to a service. Usage: scinterrogate [service name]

continue

Sends a CONTINUE control request to a service. Usage: sccontinue [service name]

stop

Sends a STOP request to a service. Usage: scstop [service name]
= Optional reason code number for service stop formed with the following elements in the format: Flag:Major reason:Minor reason [E.g., 1:2:8 means Hardware: Disk (Unplanned)] Flag
------------------
1 - Unplanned
2 - Custom
4 - Planned Major reason
------------------
1 - Other
2 - Hardware
3 - Operating System
4 - Software
5 - Application
64-255 - Custom Minor reason
------------------
1 - Other
2 - Maintenance
3 - Installation
4 - Upgrade
5 - Reconfiguration
6 - Hung
7 - Unstable
8 - Disk
9 - Network Card
10 - Environment
11 - Hardware Driver
12 - Other Driver
13 - Service Pack
14 - Software Update
15 - Security Fix
16 - Security
17 - Network Connectivity
18 - WMI
19 - Service Pack Uninstall
20 - Software Update Uninstall
22 - Security Fix Uninstall
23 - MMC
256-65535 - Custom= Optional comment for the reason above (127 character maximum)

config

Changes the configuration of a service (persistent). Usage: scconfig [service name]... Options:

type=	< own\|share\|interact\|kernel\|filesys\|rec\|adapt\|userown\|usershare>
start=	< boot\|system\|auto\|demand\|disabled\|delayed-auto>
error=	< normal\|severe\|critical\|ignore>
binPath=	< binarypathname to="" the="" .exe="" file="" >
group=	< LoadOrderGroup >
tag=	< yes\|no>
depend=	< dependencies(separated by="" (forward="" slash))="">
obj=	< accountname\|objectname>
DisplayName=	< display name >
password=	< password >

description

Changes the description of a service. Usage: scdescription [service name] [description]

failure

Changes the actions taken by a service upon failure. Usage: scfailure [service name]... Options:

reset=	(Must be used in conjunction with actions= )
reboot=	< Message broadcast before rebooting on failure >
command=	< Command line to be run on failure >
actions=	< Failure actions and their delay time (in milliseconds), separated by / (forward slash) -- e.g., run/5000/reboot/800 Valid actions are (Must be used in conjunction with the reset= option)

failureflag

Changes the failure actions flag setting of a service. If this setting is 0 (default), the SCM (Service Control Manager) enables configured failure actions on the service only if the service process terminates with the service in a state other than SERVICE_STOPPED. If this setting is 1, the SCM enables configured failure actions on the service if the service enters the SERVICE_STOPPED state with a Win32 exit code other than 0 in addition to the service process termination as above. This setting is ignored if the service does not have any failure actions configured. Usage: scfailureflag [service name] [flag]

sidtype

Changes the SID (service security identifier) type setting of a service. If this setting is "unrestricted," the SCM will add this service's SID to the service process token when the service process starts the next time due to the first service in the process being started. This setting is valid only for Win32 user mode services. If this setting is "restricted," the SCM will add this service's SID to the service process token when the service process starts the next time due to the first service in the process being started. Also, this service's SID is added to the restricting SID list in the process token. The process token will be a restricted token. See MSDN for details on a restricted token. This setting is valid only for Win32 user mode services. Also, for a share process service, all services cohosted in the process must have this SID type set for this to take effect. If this setting is "none," the SCM will not add the service's SID to the service process token. Usage: scsidtype [service name] [type] Options:

type

privs

Changes the required privileges setting of a service. The privilege settings take effect when the service process starts due to the first service in the process being started. At that time, the SCM (Service Control Manager) computes the union of all privileges required by all services that will be hosted in the same process and then creates the process with those privileges. An absence of this setting is taken to imply that the service requires all the privileges that the security subsystem allows for the process running in the service's configured account. Usage: scprivs [service name] [privileges] Options:

privileges

[E.g., SeBackupPrivilege/SeRestorePrivilege]

managedaccount

Changes whether the account in which the service runs uses a managed password. If this setting is "true", the SCM will request the account password from NetLogon when starting the service. If this setting is "false", the SCM will use the configured account password. Usage: scmanagedaccount [service name] [type] Options:

type

Queries the configuration information for a service. Usage: scqc [service name]

qdescription

Queries the description for a service. Usage: scqdescription [service name]

qfailure

Queries the actions taken by a service upon failure. Usage: scqfailure [service name]

qfailureflag

Retrieves the failure actions flag setting of a service. If this setting is 0 (default), the SCM (Service Control Manager) enables configured failure actions on the service only if the service process terminates with the service in a state other than SERVICE_STOPPED. If this setting is 1, the SCM enables configured failure actions on the service if the service enters the SERVICE_STOPPED state with a Win32 exit code other than 0 in addition to the service process termination as above. This setting is ignored if the service does not have any failure actions configured. Usage: scqfailureflag [service name]

qsidtype

Queries the SID (service security identifier) type setting of a service. If this setting is "unrestricted," the SCM (Service Control Manager) will add this service's SID to the service process token when the service process starts the next time due to the first service in the process being started. This setting is valid only for Win32 user mode services. If this setting is "restricted," the SCM will add this service's SID to the service process token when the service process starts the next time due to the first service in the process being started. Also, this service's SID is added to the restricting SID list in the process token. The process token will be a restricted token. See MSDN for details on a restricted token. This setting is valid only for Win32 user mode services. Also, for a share process service, all services cohosted in the process must have this SID type set for this to take effect. If this setting is "none," the SCM will not add the service's SID to the service process token. Usage: scqsidtype [service name]

qprivs

Queries the required privileges setting for a service. The privilege settings take effect when the service process starts due to the first service in the process being started. At that time, the SCM computes the union of all privileges required by all services that will be hosted in the same process and then creates the process with those privileges. An absence of this setting is taken to imply that the service requires all the privileges that the security subsystem allows for a process running in the service's configured account. Usage: scqprivs [service name]

qtriggerinfo

Queries the trigger parameters of a service. Usage: scqtriggerinfo [service name]

qpreferrednode

Queries the preferred NUMA node for a Win32 service. This setting is valid only for its own process services. If the service has no preferred node setting, then the query will fail. Usage: scqpreferrednode [service name]

qmanagedaccount

Queries whether a service uses an account with a password managed by LSA. Usage: scqmanagedaccount [service name]

qprotection

Queries whether the service is marked to start in a protected process. Note that this setting cannot be changed. Usage: scqprotection [service name]

quserservice

Queries for a user service instance for the current user in the same session created from the user service template specified. Usage: sc quserservice

delete

Deletes a service entry from the Registry. If the service is running, or another process has an open handle to the service, the service is marked for deletion. Usage: scdelete [service name]

create

Creates a service entry in the Registry and Service Database. Usage: sccreate [service name] [binPath= ]... Options:

type=	< own\|share\|interact\|kernel\|filesys\|rec\|userown\|usershare> (default = own)
start=	< boot\|system\|auto\|demand\|disabled\|delayed-auto> (default = demand)
error=	< normal\|severe\|critical\|ignore> (default = normal)
binPath=	< binarypathname to="" the="" .exe="" file="" >
group=	< LoadOrderGroup >
tag=	< yes\|no>
depend=	< dependencies(separated by="" (forward="" slash))="" >< /dependencies(separated >
obj=	< accountname\|objectname > (default = LocalSystem)
DisplayName=	< display name >
password=	< password >

control

Sends a control to a service. Usage: sccontrol [service name]
= user-defined control code
= See also sc stop, sc pause, etc.

sdshow

Displays a service's security descriptor. Usage: scsdshow

sdset

Sets a service's security descriptor. Usge: scsdset

showsid

Displays the service SID string corresponding to an arbitrary name. The name can be that of an existing or non-existent service. Usage: sc showsid [name]

triggerinfo

Configures the trigger parameters of a service. Usage: sctriggerinfo [service name]... Options:

start/device/UUID/HwId1/...	< Start the service on arrival of the specified device interface class UUID string with one or more hardware ID strings or compatible ID strings >
start/custom/UUID/data0/..	< Start the service on arrival of an event from the specified custom ETW provider UUID string with one or more binary data items in hexadecimal string format such as ABCDABCD to set 4-byte data >
stop/custom/UUID/data0/...	< Stop the service on arrival of an event from the specified custom ETW provider UUID string with one or more binary data items in hexadecimal string format such as ABCDABCD to set 4-byte data >
start/strcustom/UUID/data0/..	< Start the service on arrival of an event from the specified custom ETW provider UUID string with one or more optional string data items >
stop/strcustom/UUID/data0/..	< Stop the service on arrival of an event from the specified custom ETW provider UUID string with one or more optional string data items >
start/lvlcustom/UUID/data0/..	< Start the service on arrival of an event from the specified custom ETW provider UUID string with a level higher or equal to the data items in hexadecimal number format such as 0x01 >
stop/lvlcustom/UUID/data0/..	< Stop the service on arrival of an event from the specified custom ETW provider UUID string with a level higher or equal to the data items in hexadecimal number format such as 0x01 >
start/kwanycustom/UUID/data0/..	< Start the service on arrival of an event from the specified custom ETW provider UUID string with a keyword that matches any of the bits in the data items in hexadecimal number format such as 0x0A03 >
stop/kwanycustom/UUID/data0/..	< Stop the service on arrival of an event from the specified custom ETW provider UUID string with a keyword that matches any of the bits in the data items in hexadecimal number format such as 0x0A03 >
start/kwallcustom/UUID/data0/..	< Start the service on arrival of an event from the specified custom ETW provider UUID string with a keyword that matches all of the bits in the data items in hexadecimal number format such as 0x0A03 >
stop/kwallcustom/UUID/data0/..	< Stop the service on arrival of an event from the specified custom ETW provider UUID string with a keyword that matches all of the bits in the data items in hexadecimal number format such as 0x0A03 >
start/networkon	< Start the service on first IP address >
stop/networkoff	< Stop the service on zero IP addresses >
start/domainjoin	< Start the service on domain join >
stop/domainleave	< Stop the service on domain leave >
start/portopen/parameter	< start the="" service="" on="" opening="" of="" a="" network="" port.="" parameter="" is="" semi-colon="" delimited="" form="" portnumber;protocolname;imagepath;="" servicename="">
stop/portclose/parameter	< stop the="" service="" on="" closing="" of="" a="" network="" port.="" parameter="" is="" semi-colon="" delimited="" form="" portnumber;protocolname;imagepath;="" servicename="">
start/machinepolicy	< Start the service when machine group policy changes or is present at boot >
start/userpolicy	< Start the service when user group policy changes or is present at boot >
start/rpcinterface/UUID	< Start the service when a request arrives at the RPC Endpoint Mapper for the given interface >
start/namedpipe/pipename	< start the="" service="" when="" a="" request="" arrives="" for="" specified="" named="" pipe.="" do="" not="" include="" "\\.\pipe\"="" portion="" of="" pipe's="" name="" >
delete	< Delete the existing trigger parameters >

preferrednode

Changes the preferred NUMA node for a Win32 service. This setting is valid only for its own process services. To delete an existing setting, set the node number as -1. If an invalid preferred node number is supplied, then the change request will fail. Usage: scpreferrednode [service name] [node number]

GetDisplayName

Gets the DisplayName for a service. Usage: scGetDisplayName

GetKeyName

Gets the key name associated with a particular service, using the display name as input. Usage: scGetKeyName

EnumDepend

Enumerates Service Dependencies. Usage: scEnumDepend

The following commands don't require a service name:
sc

boot	(ok \| bad) Indicates whether the last boot should be saved as the last-known-good boot configuration
Lock	Locks the Service Database
QueryLock	Queries the LockStatus for the SCManager Database

QUERY and QUERYEX OPTIONS

If the query command is followed by a service name, the status for that service is returned. Further options do not apply in this case. If the query command is followed by nothing or one of the options listed below, the services are enumerated.

type=	Type of services to enumerate (driver, service, userservice, all) (default = service)
state=	State of services to enumerate (inactive, all) (default = active)
bufsize=	The size (in bytes) of the enumeration buffer (default = 4096)
ri=	The resume index number at which to begin the enumeration (default = 0)
group=	Service group to enumerate (default = all groups)

查看英文版

sc 示例

st start hope

如果“hope”服務(wù)存在，則此代碼將啟動(dòng)它。

sc query

枚舉活動(dòng)服務(wù)和驅(qū)動(dòng)程序的狀態(tài)。

sc query eventlog

顯示事件日志服務(wù)的狀態(tài)。

st start hope

If the "hope" service existed, this code would start it.

sc query

Enumerates the status for active services & drivers.

sc query eventlog

Displays the status for the eventlog service.

查看英文版

其他命令行

如此好文，分享給朋友