Alternative Methods to Query Windows Service Executable Path When SC QC Fails


1 views

The standard sc qc command is indeed the go-to method for querying service configurations, including the executable path. However, as highlighted in the error message, it fails when the returned data exceeds the default buffer size. The error code 122 (ERROR_INSUFFICIENT_BUFFER) indicates Microsoft's implementation doesn't automatically retry with a larger buffer.

Windows PowerShell provides more reliable methods through WMI and CIM:

Get-WmiObject Win32_Service -Filter "Name='myServiceName'" | Select-Object PathName
# OR (for newer systems):
Get-CimInstance Win32_Service -Filter "Name='myServiceName'" | Select-Object PathName

Services store their configuration in the registry. This command extracts the path:

reg query "HKLM\SYSTEM\CurrentControlSet\Services\myServiceName" /v ImagePath

For legacy systems without PowerShell:

wmic service where "name='myServiceName'" get pathname

For programmatic solutions, here's a C# snippet using ServiceController:

using System.ServiceProcess;

var service = new ServiceController("myServiceName");
string path = service.ServiceName; // Requires additional permissions
// More complete implementation would use ManagementObjectSearcher

Note that service paths might contain environment variables or quotes. Use ExpandEnvironmentStrings when processing the results programmatically.

These methods bypass the buffer limitation by either:

  • Using more modern APIs (PowerShell)
  • Accessing the configuration store directly (Registry)
  • Implementing proper buffer handling (C#)

When querying Windows service configurations, many administrators and developers encounter the frustrating error:

[SC] QueryServiceConfig FAILED 122:
The data area passed to a system call is too small.
[SC] GetServiceConfig needs 1094 bytes

This occurs because the sc qc command has a fixed buffer size that may be insufficient for certain service configurations. While the error suggests increasing the buffer size, the sc.exe utility doesn't provide this capability.

Method 1: Using WMI (Windows Management Instrumentation)

The most robust approach is using WMI through PowerShell or command-line:

wmic service where "name='servicename'" get pathname

Example with specific service:

wmic service where "name='wuauserv'" get pathname

Method 2: PowerShell Get-WmiObject

For more detailed information:

Get-WmiObject -Class Win32_Service -Filter "Name='servicename'" | Select-Object PathName

Method 3: PowerShell Get-CimInstance (Modern Systems)

Get-CimInstance -ClassName Win32_Service -Filter "Name='servicename'" | Select-Object PathName

Method 4: Registry Query

Services store their configuration in the registry at:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

You can query it with:

reg query "HKLM\SYSTEM\CurrentControlSet\Services\servicename" /v ImagePath

Group Managed Service Accounts (gMSA)

For services running under gMSA, you might need to add:

Get-CimInstance -ClassName Win32_Service -Filter "Name='servicename'" | 
Select-Object Name, PathName, StartName

Services with Long Paths

Some services (particularly SQL Server) have extremely long paths that may trigger buffer issues. The WMI methods above handle these cases better than sc qc.

Here's a PowerShell function to get all service paths:

function Get-ServicePaths {
    param(
        [string]$Filter = "*"
    )
    Get-CimInstance -ClassName Win32_Service -Filter "Name LIKE '$Filter'" |
    Select-Object Name, DisplayName, State, PathName |
    Sort-Object Name
}

The buffer size issue in sc qc stems from its legacy implementation. Modern alternatives like WMI and PowerShell:

  • Dynamically allocate memory as needed
  • Handle UNC paths and long filenames better
  • Provide more detailed error information
  • Allow filtering and formatting of results