{"record":{"id":"13eb069acef5fa3a","repo":"projectdiscovery/nuclei","slug":"svcctl-open-scm-w-13eb06","errorCode":null,"errorMessage":"svcctl open scm: %w","messagePattern":"svcctl open scm: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/dcerpc/enum.go","lineNumber":79,"sourceCode":"//\t  if (s.State === 'RUNNING') { log(s.Name + ' => ' + s.DisplayName); }\n//\t}\n//\n// ```\nfunc (c *Client) EnumServices() ([]ServiceEntry, error) {\n\tif !protocolstate.IsHostAllowed(c.nj.ExecutionId(), c.Host) {\n\t\treturn nil, protocolstate.ErrHostDenied.Msgf(c.Host)\n\t}\n\trpc, err := c.rpcOverNamedPipe(\"svcctl\", gpsvcctl.UUID, gpsvcctl.MajorVersion, gpsvcctl.MinorVersion)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tdefer func() {\n\t\t_ = rpc.Transport.Close()\n\t}()\n\n\tsc, err := gpsvcctl.NewServiceController(rpc)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"svcctl open scm: %w\", err)\n\t}\n\tdefer sc.Close()\n\n\tconst serviceWin32 = gpsvcctl.SERVICE_WIN32_OWN_PROCESS | gpsvcctl.SERVICE_WIN32_SHARE_PROCESS\n\traw, err := sc.EnumServicesStatus(serviceWin32, gpsvcctl.SERVICE_STATE_ALL)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn mapServiceEntries(raw), nil\n}\n\n// EnumSessions lists SMB sessions known to the server via SRVSVC\n// (nmap: smb-enum-sessions). Often requires administrative rights.\n//\n// @example\n// ```javascript\n// const dcerpc = require('nuclei/dcerpc');\n// const c = new dcerpc.Client('fs01.acme.local', 'acme.local', 'admin', 'P@ssw0rd');","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/dcerpc/enum.go#L61-L97","documentation":"EnumServices opens the Service Control Manager via NewServiceController over the svcctl pipe and it failed — the same OpenSCManagerW access-denied family as error 211, hit on the enumeration path (nmap smb-enum-services parity). Service enumeration through this client requires admin-level SCM access.","triggerScenarios":"c.EnumServices() with non-admin credentials, or svcctl denied by firewall/EDR; machines blocking Remote Service Management by policy.","commonSituations":"Non-privileged inventory scans expecting service lists; hardened hosts; Remote Service Management firewall groups disabled.","solutions":["Use administrator credentials for the target.","Enable the Remote Service Management firewall rules and the Server service.","Fall back to reading the service list from the registry over SMB (HKLM\\SYSTEM\\CurrentControlSet\\Services) which needs only Remote Registry access.","Verify 445 reachability first — a different error would appear otherwise."],"exampleFix":"// before\nconst c = new dcerpc.Client('wk01', 'ACME', 'bob', 'pass');\nc.EnumServices(); // svcctl open scm: ACCESS_DENIED\n\n// after\nconst c = new dcerpc.Client('wk01', 'ACME', 'adm', 'adm-pass');\ntry {\n  c.EnumServices();\n} catch (e) {\n  log('SCM denied; enumerate services via registry instead: ' + e);\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const svc = c.EnumServices();\n} catch (e) {\n  const msg = String(e);\n  if (msg.includes('svcctl open scm')) {\n    // SCM denied: needs admin — fall back to registry-based service enumeration\n    log('SCM denied, use registry fallback: ' + msg);\n  } else throw e;\n}","preventionTips":["Run service enumeration with admin credentials or plan a registry-read fallback.","Enable Remote Service Management firewall groups on scan targets.","Mark SCM-based enumeration as unavailable for hosts that deny it, to avoid repeat failures."],"tags":["svcctl","scm","enumeration","windows","privileges"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}