How does a Windows service differ from a standard exe?

Question

What\'s the difference between a Windows service and a standard exe?

Answer 1

A Windows service has a special ServiceMain function and must respond to Service Control Manager (SCM) commands properly in order to be functional as a service. On the other hand, a regular executable has a main or WinMain function and doesn't need to respond to any particular control commands.

Answer 2

A windows service always runs once the computer starts up (as long as it's so configured). A standard EXE only runs when a user is logged in, and will stop if the user logs out.

You would use a windows service for things that always need to run even if nobody is logged in.

You would use a standard EXE for programs that a user will run while logged in.

Answer 3

A service is (usually) is a standard exe with no UI. It can run even when there is no user logged into the machine, and it's access rights and view of the file system is no dependent on what user is logged in.

Answer 4

From the perspective of the EXE Binary and from the perspective of the Compiler's C Library, a Windows service looks exactly like a standard Unix program or a Windows console program. i.e with main() entry point. What makes a service different is how it is loaded / invoked by Microsoft Windows (from the registry, usually at boot). A service can (and should) tell the SC.exe application [Service Control Manager] via Windows API calls, that the service is started, stopped, suspended, etc.

Answer 5

If you're talking about implementing a background operation, here are the criteria I'd recommend to choose a service or a window-less .exe:

Choose an exe if:

• You need it to run on a per-user basis and only when a user is logged in
• You need it to interact with the Windows desktop (notification icons, etc.)
• It needs all the privileges of the logged-in user (no more, no less)

Choose a service if:

• It may need to run when no one is logged in
• It doesn't generally need per-user data or privilege
• It solely communicates with the network
• It needs to expose new "securable" objects. Objects that have their own Declarative Access Control Lists (DACL's) that limit access to certain accounts/groups.
• It needs special permissions that may not be available to the logged-in user.

Services can easily be security holes, so prefer .exe's to services. Sometimes you'll need both. A virus checker needs to be able to access every file on the filesystem (which the current user may not be able to do), but it also needs to provide info to the user in the form of notification dialogs/pop-ups and a tool tray icon. Services can't interact with the user's GUI directly. They can use the standard Windows IPC (inter-process communication) services such as pipes and shared memory regions. Such tools usually have both a service and a per-user windowless .exe that communicates with the service using Windows pipes or shared memory regions.

Get "Programming Windows Security" by Keith Brown if you want to dive into these topics.