The Original Service Host

SVCHOST was not Microsoft’s first design for hosting service DLLs in a shared process. Right from Windows NT 3.51, SERVICES.EXE was not only the Services Control Manager but was also the host process for a baker’s dozen of service DLLs. Two more were added in Windows NT 4.0. Then the fun begins for historians, for despite the development of SVCHOST for Windows 2000, service DLLs continued to be written for running in the SERVICES process. Use of the Services Control Manager as a service host didn’t stop until Windows Vista.

There is no configurability for the sort of service DLL that is hosted by SERVICES. The names of the supported services and of their corresponding DLLs are hard-coded in the SERVICES executable. In the early versions, the calling point for starting the service is necessarily named ServiceEntry, and is essentially a ServiceMain with two extra arguments. Windows 2000 and higher allow that the name need not be ServiceEntry, but there is still no configurability: the function name joins the other names in being hard-coded, with ServiceEntry persisting as a default.

Service Service DLL Entry Point Supported SERVICES Versions
ALERTER alrsvc.dll SvcEntry_Alerter 3.51 to 5.0
AppMgmt appmgmts.dll SvcEntry_AppMgmt 5.0
BROWSER browser.dll SvcEntry_Browser 3.51 to 5.0
CiSvc query.dll SvcEntry_CiSvc 5.0
DHCP dhcpcsvc.dll SvcEntry_DHCP 3.51 to 5.0
dmserver dmserver.dll SvcEntry_dmserver 5.0
DnsCache dnsrslvr.dll SvcEntry_DnsCache 5.0
EVENTLOG eventlog.dll SvcEntry_Eventlog 3.51 to 5.2
LanmanServer srvsvc.dll SvcEntry_Server 4.0 to 5.0
LanmanWorkstation wkssvc.dll SvcEntry_Workstation 3.51 to 5.0
LMHOSTS lmhsvc.dll SvcEntry_LmHosts 3.51 to 5.0
MESSENGER msgsvc.dll SvcEntry_Messenger 3.51 to 5.0
NBT nbtsvc.dll   3.51 to 4.0
NtLmSsp ntlmssps.dll   3.51 to 4.0
NWCWorkstation nwwks.dll SvcEntry_NWCS 3.51 to 5.0
NwSapAgent nwsap.dll   3.51 to 4.0
PlugPlay umpnpmgr.dll SvcEntry_PlugPlay 4.0 to 5.2
ProtectedStorage cryptsvc.dll SvcEntry_ProtectedStorage 5.0
seclogon seclogon.dll SvcEntry_Seclogon 5.0
TCPIP tcpipsvc.dll   3.51 to 4.0
Telnet telnet.dll   3.51 to 4.0
TrkSvr trksvr.dll SvcEntry_TrkSvr 5.0
TrkWks trkwks.dll SvcEntry_TrkWks 5.0
W32Time w32time.dll SvcEntry_W32Time 5.0
Wmi wmicore.dll SvcEntry_WMI 5.0

As of Windows Vista, all these services are adapted for hosting by SVCHOST, or are discontinued or otherwise re-implemented. However, SERVICES version 6.0 (from Windows Vista) does still have much of the code for hosting service DLLs. It’s just that its table of services to host is empty. Indeed, it seems most plausible that all the code remains in the source files, and is missed in the executable only because the compiler and linker determine that it is unreachable or unreferenced.