Services and drivers

TODO this page currently contains rough notes, fine tune these

Settings to load/run drivers and services are stored in the Services key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Sub keys:

Name Description
%NAME% The driver or service sub key. Where %NAME% corresponds with the name of the driver or service.

Name sub key

Sub keys:

Name Description
Cache
DeviceInRange
Linkage
Options
Parameters
Performance
Security
Settings
StartOverride
tracing

Values:

Name Data type Description
DependOnGroup REG_MULTI_SZ Other groups the device or service is dependent on.
DependOnService REG_MULTI_SZ Other services the device or service is dependent on.
Description REG_SZ Description.
DisplayName REG_SZ, REG_MULTI_SZ Display name.
DriverPackageId
ErrorControl REG_DWORD The level of error control.
FailureActions
Group REG_SZ Name of the group the device or service is part of.
ImagePath REG_SZ Path and filename of device or service executable file (or image).
ObjectName REG_SZ See section: ObjectName value
RequiredPrivileges
Start REG_DWORD The start control value.
ServiceSidType
Tag REG_DWORD
Type REG_DWORD The driver or service type.

Parameters sub key

Sub keys:

Name Description
PnpInterface
Policy
TriggerInfo
WakeUp
Wdf

Values:

Name Data type Description
AmdXataOptions REG_DWORD
AMLIMaxCTObjs REG_BINARY
APEIOSCGranted REG_BINARY
AthDfuWaitInfinite REG_DWORD
BusType REG_DWORD
DebugFlags REG_DWORD
IoTimeoutValue REG_DWORD
MaintainServerList REG_SZ
ServiceDll REG_EXPAND_SZ
ServiceDllUnloadOnStop REG_DWORD
ServiceMain REG_SZ
WHEAOSCImplemented REG_BINARY

ErrorControl value

Value Identifier Description
0x00000000 Ignore
0x00000001 Normal
0x00000002 Severe
0x00000003 Critical

ObjectName value

The ObjectName value has a different meaning for different types of Driver or Service Name sub keys.

  • For a driver type the ObjectName value contains the Windows NT driver object name that the I/O Manager uses to load the device driver.

  • For a service type the ObjectName value contains the account name under which the service will log on to run.

Windows Services shows this value as “LogOn As”.

Start value

Value Identifier Description
0x00000000 Boot Driver or service controlled by the kernel that is loaded by the boot loader.
0x00000001 System Driver or service controlled by the I/O sub system that is loaded at kernel initialization.
0x00000002 Automatic Driver or service controlled by the Services Control Manager that is loaded at start up. Also referred to as: Auto load
0x00000003 On demand Driver or service controlled by the Services Control Manager that is loaded on demand. Also referred to as: Load on demand or Automatic (Delayed start)
0x00000004 Disabled Driver or service controlled by the Services Control Manager that is disabled.

Windows Services shows this value as “Startup Type”.

Type value

Value Identifier Description
0x00000001 Kernel device driver
0x00000002 File system driver
0x00000004 A set of argument for an adapter
0x00000008 Unknown, seen in combination Fs_Rec
0x00000010 Stand-alone (self-contained) service
0x00000020 Shared service
0x00000100 Unknown, seen in combination with 0x00000010 and 0x00000020. Goes back to Windows 2000 maybe to indicate a network service.