Note that Windows services need to use an additional set of API calls that are not normally implemented in regular executables. While it is possible to run a normal executable as a service, the command will not survive for long (making a stable reverse shell impossible) and will always registered as failed (potentially alerting defenders).

Service security

Service configurations are stored in the Registry under HKLM\SYSTEM\CurrentControlSet\Services; here the user is represented by the ObjectName value. DACLs are stored under each service as a Security sub-key.

Loading drivers

If binPath points to a driver (.sys) rather than an executable, then that driver will be loaded into the kernel when the service is started!