Service Control Manager

Service Control Manager (SCM) is a special system process under the Windows NT family of operating systems, which starts, stops and interacts with Windows service processes. It is located in the codice_1 executable. Service processes interact with SCM through a well-defined API, and the same API is used internally by the interactive Windows service management tools such as the MMC snap-in codice_2 and the command-line Service Control utility codice_3. Terminating this file is used as a method of causing the Blue Screen of Death.
Implementation.
The SCM executable, codice_4, runs as a Windows console program and is launched by the Wininit process early during the system startup. Its main function, codice_5, launches all the services configured for automatic startup. First an internal database of installed services is initialized by reading the following two registry keys:
In the next step, SCM's main function codice_5 calls the function codice_13 function which checks whether the device drivers that should be started during the boot or system startup were successfully loaded, and those that have failed to do so are stored in a list called codice_14. Then a named pipe codice_15 is created as a remote procedure call interface between the SCM and the SCPs (Service Control Processes) that interact with specific services.
Next, it calls the codice_16 function which loops through all the services marked as auto-start, paying attention to the calculated load-order dependencies. In case of a circular dependency an error is noted and the service depending on a service that belongs to a group coming later in the load order is skipped. For delayed auto-start services, grouping has no effect, and those are loaded at a later stage of system startup.
For each service it wants to start, the SCM calls the codice_17 function which checks the name of the file that runs the service's process, ensuring that the account specified for the service is same as the account that the service process runs in. Every service that does not run in the codice_18 account is logged in by calling the LSASS function codice_19, for which LSASS process looks up "secret" passwords stored in the codice_20 registry key, which were stored by the SCP using the codice_21 API, when the service was originally configured. 
Next, the codice_22 function is called for every service whose service process has not been already launched. Service processes are created in a suspended state via the codice_23 API. Before the service process' execution is resumed, a named pipe codice_24 (where X is a number incremented for each service iteration) is created which serves as a communication channel between the SCM and the service process. Service process connects to the pipe by calling the codice_25 function, after which the SCM sends the service a "start" command.
Delayed auto-start services.
Delayed auto-start services have been added in Windows Vista, in order to solve the problem of a prolonged system startup, as well as to speed-up the start of critical services that cannot be delayed. Originally the auto-start method of service initialization was designed for essential system services upon which other applications and services depend. The SCM initializes the delayed services only after handling all the non-delayed auto-start services, by invoking the codice_26 function. This function queues a delayed (120 seconds by default) work item associated with a corresponding worker thread. Other than being initialized after a delay, there are no other differences between delayed and non-delayed services.
Device drivers.
Services whose codice_27 registry value is codice_28 or codice_29 are handled specially: these represent device drivers for which codice_17 calls the codice_31 function which loads the appropriate driver (usually a file with an extension codice_32) which must be located in the codice_33 directory. For that purpose, the codice_34 system call is invoked, and the codice_35 is added to the SCM's process.
Network drive letters.
SCM provides an additional functionality completely unrelated to Windows services: it notifies GUI applications such as the Windows Explorer when a network drive-letter connection has been created or deleted, by broadcasting Windows messages codice_36.