JSI Tip 0260 - What is a Service Group?

A Service Group is a collection of similar services that are loaded together at startup. Most services that appear in the HKEY_LOCAL_MACHINECurrentControlSetServices subkey are part of a Service Group. Windows NT loads one Service Group at a time. Services that are not in a group are loaded after all Service Groups are loaded.

The HKEY_LOCAL_MACHINECurrentControlSetControlServiceGroupOrder subkey determines the order in which Service Groups are loaded. The List value is a REG_MULT_SZ entry that specifies the Service Group order.

The HKEY_LOCAL_MACHINECurrentControlSetControlGroupOrderList subkey determines the order in which services within a Service Group are loaded. Services in a Service Group are assigned a tag, a unique numeric value within a Service Group which determines the service load order. Each value entry in GroupOrderList represents a Service Group. The value of the entry is a series of tags in a specified order. The first entry in this REG_BINARY value is the number of services in the group, followed by the tags in load sequence. If you look at PointerPort you can see that there are 3 services in the group and that the service with tag 02 is loaded first, followed by the service with tag 01 and then tag 03.

At a service level, the HKEY_LOCAL_MACHINECurrentControlSetServicesServiceName subkeys contain:

Group                   - this REG_SZ specifies the Service Group name that a service belongs to.
tag                        - this REG_DWORD specifies the service load sequence.
DependOnGroup  - this REG_MULTI_SZ entry defines the Service Groups which must be loaded succesfully before this service loads.
DependOnService - this REG_MULTI_SZ entry defines services that must be loaded successfully before this service loads.