Microsoft® Windows® 2000 Security Handbook

Service Startup

Let's look at what happens when a service is started. When the SCM receives a request to start a service, it first checks whether the process that contains the requested service has already been started. Most services are housed in their own process, so this is usually not the case. However, one process can contain multiple services and I get to those in a moment.

As previously mentioned, the SCM first attempts to log in the user account assigned to the service. If the logon is successful, the SCM starts the service process just like any other process (by starting its main() procedure) and assigns the security token from the logon to the new process. From there, the service makes a call to StartServiceCtrlDispatcher() that does ...