8

I'm looking for a way to figure out the command-line arguments of any Windows service.

For a non-service process, the command-line arguments can be found in the Windows Task Manager, or programmatically by using WMI as shown in this post.

Unfortunately, these two solutions don't work for a Windows service that is started by the ServiceController.Start(String[] args) method. Both of them show only the executable file path on the command-line, even though some arguments were passed in.

  1. What is the difference between two scenarios (a service vs. a non-service process)?
  2. Is there a way to figure out the arguments of the Windows service?

I also tried creating a simple service that just logs any command-line arguments it has to the event log. I started it using "sc.exe start <my service> <arg1>" and verified that <arg1> was written to the event log.

However, none of the solutions has worked for me. I still only saw the path to the executable file. My OS version is Windows Server 2008 R2 SP1 x64 Enterprise.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
Duat Le
  • 3,586
  • 2
  • 19
  • 18

5 Answers5

9

There are two types of arguments for services:

  • Arguments that were passed on the process start command line. You can get to those easily using Process Explorer, etc.
  • Arguments that were passed to the ServiceMain function. This is the WIndows API that a service is supposed to implement. The .NET equivalent is ServiceBase.OnStart. This is what is used when you do an SC START \[arguments\]. This has nothing to do with "command line process arguments".

The second type of parameters is probably only known by the service itself, if the implementation makes any use of it which is not the case for many services. I don't think Windows keep track of this when we look at low level Windows structures like the PEB: Process and Thread Structures (MSDN), even the undocumented parts of it, Undocumented functions of NTDLL.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
Simon Mourier
  • 132,049
  • 21
  • 248
  • 298
  • Thanks for the answer, Simon. You're probably right. I couldn't get a better answer from an internal mailing list. There might be some hacky way to figure this out, but I checked the SCM APIs and it doesn't seem to help. – Duat Le Jun 09 '11 at 22:02
  • This is correct. Note that a service process can contain multiple services (SvcHost.exe is a well-known example). In these cases, there are multiple `ServiceMain` calls, which makes it obvious that you need more than just the host process to find the arguments to a particular `ServiceMain`. For the same reason, you can't find the answer in the single PEB. – MSalters Oct 22 '20 at 09:31
6

You can find the service EXE file details and edit or just see the commandline options in the registry entry for the service. You'll find that under

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services

Be sure to restart the Services window if you decide to change this as it won't reread it live.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
Michael Kennedy
  • 3,202
  • 2
  • 25
  • 34
  • Thanks for the tip, but even this registry does not show the command-line arguments of the Windows service either. The closest key is "ImagePath" which shows the path to the executable of the service, like Task Manager, Procexp.exe, and the program I wrote do. – Duat Le Jun 01 '11 at 05:30
  • 1
    I've seen on at least some of the services, at the end of the ImagePath there is the commandline arguments. For example: ImagePath="c:\mongo\mongod.exe --dbperdirectory --dbpath=c:\data\mongo" – Michael Kennedy Jun 01 '11 at 15:21
  • Is "ControlSet001" same as "CurrentControlSet"? In any case, THIS is the answer I was looking for (at least not just to read, but edit it) +1 also because this answer does not assume the user has the source code (or methods to reflection because the service could have been written on C++ without .NET) And last but not least, because it's Registry, MSI/WiX can access it without external apps such as 'ProcExplorer'; Thanks!!! – HidekiAI Jun 09 '15 at 22:46
2

Try the Process Explorer application from Sysinternals

It is like Task Manager, only it lists all the running processes. Select your service and see its properties.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
Umesh CHILAKA
  • 1,466
  • 14
  • 25
  • I actually tried procexp.exe before and it also showed the same thing the Task Manager showed. I should have mentioned trying it too. Thanks by the way. – Duat Le May 31 '11 at 16:54
  • I have checked for some servies Process Explorer is showing command line arguments – Umesh CHILAKA Jun 01 '11 at 04:35
  • Which services? I edited my question to add more information. I basically tried with a simple service which I started and passed an argument using "SC.exe start ", and all the suggested solutions don't work for me. – Duat Le Jun 01 '11 at 05:32
  • I checked for SQLServer service. I'm using win7 X64 – Umesh CHILAKA Jun 01 '11 at 05:50
2

  1. A service process is not started as a usual EXE file. Even more, a service process could be just a .dll file. See: Windows service (Wikipedia).

    Many appear in the processes list in the Windows Task Manager, most often with a username of SYSTEM, LOCAL SERVICE or NETWORK SERVICE, though not all processes with the SYSTEM username are services. The remaining services run through svchost.exe as DLLs loaded into memory.

  2. Just override the ServiceBase.OnStart(string[] args) method. See more: ServiceBase.OnStart(String[]) Method (MSDN)

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
chopikadze
  • 4,219
  • 26
  • 30
  • Thanks, but I meant to ask about figuring the command-line agrugments of just any windows service, not the one I created, so I cannot override the method like you said in #2. I'm also looking for the difference between two cases, why for an interactive process I can see the arguments, but for a service I cannot. – Duat Le May 31 '11 at 16:57
1

Using Powershell you can call

(Get-CimInstance Win32_Service -Filter 'Name = "<my service>"').PathName

to get the full command line of the service (it returns file and arguments)

Just replace <my service> with the name of the desired service.

For example:

(Get-CimInstance Win32_Service -Filter 'Name = "Dnscache"').PathName

returns "C:\WINDOWS\system32\svchost.exe -k NetworkService -p"

daniol
  • 115
  • 7