How to get windows service command line arguments?

Question

I am looking for a way to figure out any command line arguments to a service.

For a maintenance-free process, command-line arguments can be found in Windows Task Manager or programmatically using WMI, as shown in this post.

Unfortunately, these two solutions do not work for a Windows service that starts the ServiceController.Start (String [] args) method. Both of them show only the path of the executable on the command line, although some arguments have been passed.

• Can someone explain the difference between the two scenarios (service vs non-serving process)?
• Is there any way to figure out the windows service arguments?

UPDATE:

I also tried to create a simple service that simply logs any command line arguments that it has in the event log. I started it with "sc.exe start <my service> <arg1>" and confirmed that <arg1> was written to the event log. However, none of the solutions worked for me. What I saw is still just the path to the executable. My OS version is Windows Server 2008 R2 Service Pack 1 (SP1) x64 Enterprise.

Answer 1

There are two types of arguments for services.

• which were passed to the process command line. You can easily access them using Process Explorer, etc.
• which were passed to the ServiceMain function. This is the WIndows API that the service should implement. The equivalent of .NET is ServiceBase.OnStart . This is what is used when you execute SC START [arguments]. This has nothing to do with “command line arguments”.

The second type of parameters is probably known only to the service itself, if the implementation uses it, which does not apply to many services. I don't think Windows tracks this when we look at low-level window structures like PEB: http://msdn.microsoft.com/en-us/library/ms684855(v=VS.85).aspx , even undocumented ones parts of it http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/NT%20Objects/Process/PEB.html

Answer 2

You can find information about the EXE service and change it, or simply view the command line parameters in the registry entry for the service. You will find that under

 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services 

Be sure to restart the Services window if you decide to change this, since it will not re-read it live.

Answer 3

try the Procexp application (ProcessExplorer) from sysInternals

It looks like a task manager. It lists all running processes, select your service and look at its properties.

Answer 4

• The service process does not start as usual. Moreover, the service process can only be a DLL file. See: http://en.wikipedia.org/wiki/Windows_service .

  Many appear in the list of processes in the Windows task manager, most often with the username SYSTEM, LOCAL SERVICE or NETWORK SERVICE, although not all processes with the name SYSTEM are services. Other services are started through svchost.exe, since DLLs are loaded into memory.

• Just override the ServiceBase.OnStart (string [] args) method. Learn more: http://msdn.microsoft.com/en-us/library/system.serviceprocess.servicebase.onstart.aspx