projectdiscovery/nuclei · error

svcctl open scm: %w

Error message

svcctl open scm: %w

What it means

EnumServices opens the Service Control Manager via NewServiceController over the svcctl pipe and it failed — the same OpenSCManagerW access-denied family as error 211, hit on the enumeration path (nmap smb-enum-services parity). Service enumeration through this client requires admin-level SCM access.

Source

Thrown at pkg/js/libs/dcerpc/enum.go:79

//	  if (s.State === 'RUNNING') { log(s.Name + ' => ' + s.DisplayName); }
//	}
//
// ```
func (c *Client) EnumServices() ([]ServiceEntry, error) {
	if !protocolstate.IsHostAllowed(c.nj.ExecutionId(), c.Host) {
		return nil, protocolstate.ErrHostDenied.Msgf(c.Host)
	}
	rpc, err := c.rpcOverNamedPipe("svcctl", gpsvcctl.UUID, gpsvcctl.MajorVersion, gpsvcctl.MinorVersion)
	if err != nil {
		return nil, err
	}
	defer func() {
		_ = rpc.Transport.Close()
	}()

	sc, err := gpsvcctl.NewServiceController(rpc)
	if err != nil {
		return nil, fmt.Errorf("svcctl open scm: %w", err)
	}
	defer sc.Close()

	const serviceWin32 = gpsvcctl.SERVICE_WIN32_OWN_PROCESS | gpsvcctl.SERVICE_WIN32_SHARE_PROCESS
	raw, err := sc.EnumServicesStatus(serviceWin32, gpsvcctl.SERVICE_STATE_ALL)
	if err != nil {
		return nil, err
	}
	return mapServiceEntries(raw), nil
}

// EnumSessions lists SMB sessions known to the server via SRVSVC
// (nmap: smb-enum-sessions). Often requires administrative rights.
//
// @example
// ```javascript
// const dcerpc = require('nuclei/dcerpc');
// const c = new dcerpc.Client('fs01.acme.local', 'acme.local', 'admin', 'P@ssw0rd');

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Use administrator credentials for the target.
2. Enable the Remote Service Management firewall rules and the Server service.
3. Fall back to reading the service list from the registry over SMB (HKLM\SYSTEM\CurrentControlSet\Services) which needs only Remote Registry access.
4. Verify 445 reachability first — a different error would appear otherwise.

Example fix

// before
const c = new dcerpc.Client('wk01', 'ACME', 'bob', 'pass');
c.EnumServices(); // svcctl open scm: ACCESS_DENIED

// after
const c = new dcerpc.Client('wk01', 'ACME', 'adm', 'adm-pass');
try {
  c.EnumServices();
} catch (e) {
  log('SCM denied; enumerate services via registry instead: ' + e);
}

try {
  const svc = c.EnumServices();
} catch (e) {
  const msg = String(e);
  if (msg.includes('svcctl open scm')) {
    // SCM denied: needs admin — fall back to registry-based service enumeration
    log('SCM denied, use registry fallback: ' + msg);
  } else throw e;
}

When it happens

Trigger: c.EnumServices() with non-admin credentials, or svcctl denied by firewall/EDR; machines blocking Remote Service Management by policy.

Common situations: Non-privileged inventory scans expecting service lists; hardened hosts; Remote Service Management firewall groups disabled.

Related errors

• svcctl open scm: %w
• winstation OpenServer: %w
• encountered errors while performing template validation
• open pipe %q: %w
• samr connect: %w

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/13eb069acef5fa3a. Report an issue: GitHub.