Microsoft® Windows® 2000 Security Handbook

Multiple Services in One Process

To throw in one additional curve, each process can contain more than one service where each service runs on a separate thread. Processes that contain multiple services must implement and register multiple primary processing procedures as well as multiple handler functions—exactly one of each for each service. But they only have one main() procedure.

Combining multiple services into one process has significant performance advantages, and that is why many, many of the services that Microsoft ships with Windows 2000 are combined into several "super server" processes. Using the sc.exe tool, I've queried the configuration (sc qc command) on several of Windows 2000's default services: the alerter, event log, DHCP client, ...