How does MSConfig determine which services are from Microsoft?

Question

I'm trying to automate the process of clean booting a computer. To do so I need to know which services are part of Windows and which services are 3rd party.

MSConfig is used in Microsoft's documentation for clean booting a computer. And it does a good job. On the Service tab, you simply check the box at the bottom that says "Hide all Microsoft services", then disable the remaining services.

So I'm trying to figure out how to programmatically determine whether a service is from Microsoft. But none of the registry keys in "HKLM\SYSTEM\CurrentControlSet\Services\" seem to indicate one way or the other.

I seem to think this is possible, because MSConfig will list the manufacturer of other non-Microsoft services just fine. I just don't know where to look for that information.

Any ideas?

Answer 1

As I do not have source code access I cannot be 100% certain but I believe this to be true. Each service is hosted by an executable file. Many are hosted by svchost.exe in the windows\system32 folder while others have their own file. These files almost always have a section known as resources. It contains information such as a short description of the file, version information, and manufacturer. Some of this is shown in the details tab of the files properties. Msconfig extracts this information anyway for display purposes so it seems likely it is also used to recognize Microsoft services.