How does a Windows service differ from a standard exe?

Question

What's the difference between a Windows service and a standard exe?

Answer 1

A windows service always runs once the computer starts up (as long as it's so configured). A standard EXE only runs when a user is logged in, and will stop if the user logs out.

You would use a windows service for things that always need to run even if nobody is logged in.

You would use a standard EXE for programs that a user will run while logged in.

Answer 2

A service is (usually) is a standard exe with no UI. It can run even when there is no user logged into the machine, and it's access rights and view of the file system is no dependent on what user is logged in.

Answer 3

A Windows service has a special ServiceMain function and must respond to Service Control Manager (SCM) commands properly in order to be functional as a service. On the other hand, a regular executable has a main or WinMain function and doesn't need to respond to any particular control commands.

Answer 4

If you're talking about implementing a background operation, here are the criteria I'd recommend to choose a service or a window-less .exe:

Choose an exe if:

• You need it to run on a per-user basis and only when a user is logged in
• You need it to interact with the Windows desktop (notification icons, etc.)
• It needs all the privileges of the logged-in user (no more, no less)

Choose a service if:

• It may need to run when no one is logged in
• It doesn't generally need per-user data or privilege
• It solely communicates with the network
• It needs to expose new "securable" objects. Objects that have their own Declarative Access Control Lists (DACL's) that limit access to certain accounts/groups.
• It needs special permissions that may not be available to the logged-in user.

Services can easily be security holes, so prefer .exe's to services. Sometimes you'll need both. A virus checker needs to be able to access every file on the filesystem (which the current user may not be able to do), but it also needs to provide info to the user in the form of notification dialogs/pop-ups and a tool tray icon. Services can't interact with the user's GUI directly. They can use the standard Windows IPC (inter-process communication) services such as pipes and shared memory regions. Such tools usually have both a service and a per-user windowless .exe that communicates with the service using Windows pipes or shared memory regions.

Get "Programming Windows Security" by Keith Brown if you want to dive into these topics.