3.1.4.7 RQueryServiceStatus (Opnum 6)

The RQueryServiceStatus method returns the current status of the specified service.

 DWORD RQueryServiceStatus(
   [in] SC_RPC_HANDLE hService,
   [out] LPSERVICE_STATUS lpServiceStatus
 );

hService: An SC_RPC_HANDLE (section 2.2.4) data type that defines the handle to the service record that MUST have been created previously using one of the open methods specified in section 3.1.4. The SERVICE_QUERY_STATUS access right MUST have been granted to the caller when the RPC context handle was created.

lpServiceStatus: Pointer to a SERVICE_STATUS (section 2.2.47) structure that contains the status information for the service.

Return Values: The method returns 0x00000000 (ERROR_SUCCESS) on success; otherwise, it returns one of the following error codes.

Return value/code	Description
5 ERROR_ACCESS_DENIED	The SERVICE_QUERY_STATUS access right had not been granted to the caller when the RPC context handle was created.
6 ERROR_INVALID_HANDLE	The handle is no longer valid.
3 ERROR_PATH_NOT_FOUND	The ImagePath of the service record identified by the hService parameter does not exist.
1115 ERROR_SHUTDOWN_IN_PROGRESS	The system is shutting down.

If the type of the service record is SERVICE_KERNEL_DRIVER or SERVICE_FILESYSTEM_DRIVER, the SCM queries the current status of the driver from the operating system and set the ServiceStatus.dwCurrentState of the service record to SERVICE_RUNNING if driver is loaded and to SERVICE_STOPPED if it is not.

In response to this request from the client, for a successful operation, the server MUST set the ServiceStatus from the service record identified by the hService parameter of the request in the lpServiceStatus parameter.

If no attempts to start the service for the service record identified by the hService parameter have been made since the last boot, the server MUST set the dwWin32ExitCode member of the lpServiceStatus parameter to 1077 ERROR_SERVICE_NEVER_STARTED.