services.exe C:\Windows\System32\services.exe

Service Control Manager (SCM): starts, stops and supervises Windows services and drivers.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

services.exe hosts the Service Control Manager (SCM). It maintains the database of installed services, automatically starts the services and drivers configured to start at boot, and gives a single interface to control them: start, stop, query. wininit.exe launches it in session 0.

What it contains

An executable signed by Microsoft in C:\Windows\System32.
The database it manages is not in the file but under HKLM\SYSTEM\CurrentControlSet\Services.
The services it starts run in their own process or in svchost.exe processes.

Risks and best practices

Do not terminate it. It is a critical process: stopping it causes a blue screen.
To act on a service, use Stop-Service, Set-Service or sc.exe, never the process.
There must be a single instance, a child of wininit.exe, in session 0, launched from System32. Any other is suspicious, such as a services.exe running from another folder.

Useful commands

# Running instance: path and parent process (should be wininit.exe)
Get-CimInstance Win32_Process -Filter "Name='services.exe'" | Select-Object ProcessId, SessionId, ParentProcessId, ExecutablePath

# Digital signature of the file
Get-AuthenticodeSignature "$env:windir\System32\services.exe" | Select-Object Status, @{n="Signer";e={$_.SignerCertificate.Subject}}

# Configuration of a service with the native SCM tool
sc.exe qc Spooler

Report a mistake