{
	"id": "320c802b-5082-4ebb-80e4-78e40aaec9ce",
	"created_at": "2026-04-06T00:18:36.86894Z",
	"updated_at": "2026-04-10T13:11:26.245873Z",
	"deleted_at": null,
	"sha1_hash": "70631fb0e186c037f2a0c93784618c36aae8c244",
	"title": "HKLM\\SYSTEM\\CurrentControlSet\\Services Registry Tree - Windows drivers",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 63375,
	"plain_text": "HKLM\\SYSTEM\\CurrentControlSet\\Services Registry Tree -\r\nWindows drivers\r\nBy EliotSeattle\r\nArchived: 2026-04-05 16:10:54 UTC\r\nThe HKLM\\SYSTEM\\CurrentControlSet\\Services registry tree stores information about each service on the\r\nsystem. Each driver has a key of the form HKLM\\SYSTEM\\CurrentControlSet\\Services\\DriverName.\r\nThe PnP manager passes this path of a driver in the RegistryPath parameter when it calls the driver's DriverEntry\r\nroutine. A driver can store global driver-defined data under the Parameters subkey of its key in the Services tree\r\nusing an AddReg directive in the driver's INF file. To access that key at runtime, a WDM driver should use\r\nIoOpenDriverRegistryKey with a DRIVER_REGKEY_TYPE of DriverRegKeyParameters and a WDF driver\r\nshould use WdfDriverOpenParametersRegistryKey. Information that is stored under this key is available to the\r\ndriver during its initialization.\r\nFor more info about registry keys that drivers typically use, see Introduction to Registry Keys for Drivers.\r\nAdditional Keys in HKLM\\SYSTEM\\CurrentControlSet\\Services\r\nParameters\r\nA key that is used to store driver-specific data. For some types of drivers, the system expects to find specific value\r\nentries. You can add value entries to this subkey using AddReg directives in the driver's INF file.\r\nPerformance\r\nA key that specifies information for optional performance monitoring. The values under this key specify the name\r\nof the driver's performance DLL and the names of certain exported functions in that DLL. You can add value\r\nentries to this subkey using AddReg directives in the driver's INF file.\r\nCommon Registry Keys and Values in\r\nHKLM\\SYSTEM\\CurrentControlSet\\Services\u003cDriverName\u003e\r\nStart\r\nThe Start value specifies when the service should be started. It can have one of the following values:\r\n0x0 (Boot): Loaded by the boot loader.\r\n0x1 (System): Loaded by the I/O subsystem.\r\n0x2 (Automatic): Loaded automatically by the Service Control Manager during system startup.\r\n0x3 (Demand): Loaded automatically by PnP if it is needed for a device.\r\n0x4 (Disabled): The service is disabled and will not be loaded.\r\nhttps://docs.microsoft.com/en-us/windows-hardware/drivers/install/hklm-system-currentcontrolset-services-registry-tree\r\nPage 1 of 2\n\nType\r\nThe Type value specifies the type of service. It can be a combination of the following values:\r\n0x1 (Kernel driver): A device driver.\r\n0x2 (File system driver): A file system driver.\r\n0x10 (Win32 own process): A Win32 program that runs in its own process.\r\n0x20 (Win32 share process): A Win32 program that shares a process with other services.\r\nErrorControl\r\nThe ErrorControl value specifies the severity of the error if the service fails to start. It can have one of the\r\nfollowing values:\r\n0x0 (Ignore): The error is ignored, and the startup continues.\r\n0x1 (Normal): The error is logged, a message box may be displayed, but startup continues.\r\n0x2 (Severe): The error is logged, and the system is restarted with the last-known-good configuration.\r\n0x3 (Critical): The error is logged, and the system attempts to restart with the last-known-good\r\nconfiguration. If this fails, startup fails, and the system halts.\r\nAdditional Common Values\r\nImagePath : Specifies the path to the service binary. Windows creates this value by using the required\r\nServiceBinary entry in the driver's INF file. This entry is in the service-install-section referenced by the\r\ndriver's INF AddService directive.\r\nDisplayName : The friendly name of the service.\r\nDescription : A description of the service.\r\nExample\r\nHere is an example of a registry entry for a service:\r\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\ExampleService]\r\n\"Start\"=dword:00000002\r\n\"Type\"=dword:00000010\r\n\"ErrorControl\"=dword:00000001\r\n\"ImagePath\"=\"C:\\\\Program Files\\\\ExampleService\\\\example.exe\"\r\n\"DisplayName\"=\"Example Service\"\r\n\"Description\"=\"This is an example service.\"\r\nSource: https://docs.microsoft.com/en-us/windows-hardware/drivers/install/hklm-system-currentcontrolset-services-registry-tree\r\nhttps://docs.microsoft.com/en-us/windows-hardware/drivers/install/hklm-system-currentcontrolset-services-registry-tree\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://docs.microsoft.com/en-us/windows-hardware/drivers/install/hklm-system-currentcontrolset-services-registry-tree"
	],
	"report_names": [
		"hklm-system-currentcontrolset-services-registry-tree"
	],
	"threat_actors": [],
	"ts_created_at": 1775434716,
	"ts_updated_at": 1775826686,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/70631fb0e186c037f2a0c93784618c36aae8c244.pdf",
		"text": "https://archive.orkl.eu/70631fb0e186c037f2a0c93784618c36aae8c244.txt",
		"img": "https://archive.orkl.eu/70631fb0e186c037f2a0c93784618c36aae8c244.jpg"
	}
}