diff --git a/base/services/umpnpmgr/event.c b/base/services/umpnpmgr/event.c
index a77515684e6..e1e8f1d9cb2 100644
--- a/base/services/umpnpmgr/event.c
+++ b/base/services/umpnpmgr/event.c
@@ -121,8 +121,9 @@ ProcessDeviceClassChangeEvent(
     RPC_STATUS RpcStatus;
     PLIST_ENTRY Current;
     PNOTIFY_ENTRY pNotifyData;
-    PDEV_BROADCAST_DEVICEINTERFACE_W pData;
+    PDEV_BROADCAST_DEVICEINTERFACE_W pEventData;
     DWORD dwSize;
+    DWORD dwEventType;
 
     DPRINT("ProcessDeviceClassChangeEvent(%p)\n", PnpEvent);
     DPRINT("SymbolicLink: %S\n", PnpEvent->DeviceClass.SymbolicLinkName);
@@ -142,33 +143,45 @@ ProcessDeviceClassChangeEvent(
             ((pNotifyData->ulFlags & DEVICE_NOTIFY_ALL_INTERFACE_CLASSES) ||
              (UuidEqual(&PnpEvent->DeviceClass.ClassGuid, &pNotifyData->ClassGuid, &RpcStatus))))
         {
+            if (UuidEqual(&PnpEvent->EventGuid, (UUID*)&GUID_DEVICE_INTERFACE_ARRIVAL, &RpcStatus))
+            {
+                DPRINT("Interface arrival: %S\n", PnpEvent->DeviceClass.SymbolicLinkName);
+                dwEventType = DBT_DEVICEARRIVAL;
+            }
+            else if (UuidEqual(&PnpEvent->EventGuid, (UUID*)&GUID_DEVICE_INTERFACE_REMOVAL, &RpcStatus))
+            {
+                DPRINT("Interface removal: %S\n", PnpEvent->DeviceClass.SymbolicLinkName);
+                dwEventType = DBT_DEVICEREMOVECOMPLETE;
+            }
+            else
+            {
+                dwEventType = 0;
+            }
+
+            dwSize = sizeof(DEV_BROADCAST_DEVICEINTERFACE_W) + wcslen(PnpEvent->DeviceClass.SymbolicLinkName) * sizeof(WCHAR);
+            pEventData = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, dwSize);
+            if (pEventData)
+            {
+                pEventData->dbcc_size = dwSize;
+                pEventData->dbcc_devicetype = DBT_DEVTYP_DEVICEINTERFACE;
+                CopyMemory(&pEventData->dbcc_classguid, &PnpEvent->DeviceClass.ClassGuid, sizeof(GUID));
+                wcscpy(pEventData->dbcc_name, PnpEvent->DeviceClass.SymbolicLinkName);
+            }
+
             if ((pNotifyData->ulFlags & DEVICE_NOTIFY_SERVICE_HANDLE) == DEVICE_NOTIFY_WINDOW_HANDLE)
             {
-                dwSize = sizeof(DEV_BROADCAST_DEVICEINTERFACE_W) + wcslen(PnpEvent->DeviceClass.SymbolicLinkName) * sizeof(WCHAR);
-                pData = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, dwSize);
-
-                pData->dbcc_size = dwSize;
-                pData->dbcc_devicetype = DBT_DEVTYP_DEVICEINTERFACE;
-                CopyMemory(&pData->dbcc_classguid, &PnpEvent->DeviceClass.ClassGuid, sizeof(GUID));
-                wcscpy(pData->dbcc_name, PnpEvent->DeviceClass.SymbolicLinkName);
-
-                if (UuidEqual(&PnpEvent->EventGuid, (UUID*)&GUID_DEVICE_INTERFACE_ARRIVAL, &RpcStatus))
-                {
-                    DPRINT("Interface arrival: %S\n", PnpEvent->DeviceClass.SymbolicLinkName);
-                    SendMessageW((HANDLE)pNotifyData->hRecipient, WM_DEVICECHANGE, DBT_DEVICEARRIVAL, (LPARAM)pData);
-                }
-                else if (UuidEqual(&PnpEvent->EventGuid, (UUID*)&GUID_DEVICE_INTERFACE_REMOVAL, &RpcStatus))
-                {
-                    DPRINT("Interface removal: %S\n", PnpEvent->DeviceClass.SymbolicLinkName);
-                    SendMessageW((HANDLE)pNotifyData->hRecipient, WM_DEVICECHANGE, DBT_DEVICEREMOVECOMPLETE, (LPARAM)pData);
-                }
-
-                HeapFree(GetProcessHeap(), 0, pData);
+                SendMessageW((HANDLE)pNotifyData->hRecipient, WM_DEVICECHANGE, (WPARAM)dwEventType, (LPARAM)pEventData);
             }
             else if ((pNotifyData->ulFlags & DEVICE_NOTIFY_SERVICE_HANDLE) == DEVICE_NOTIFY_SERVICE_HANDLE)
             {
-                DPRINT1("Service notification is not implemented yet!\n");
+                I_ScSendPnPMessage((SERVICE_STATUS_HANDLE)pNotifyData->hRecipient,
+                                   SERVICE_CONTROL_DEVICEEVENT,
+                                   dwEventType,
+                                   pEventData);
             }
+
+            if (pEventData)
+                HeapFree(GetProcessHeap(), 0, pEventData);
         }
 
         Current = Current->Flink;
diff --git a/base/system/services/rpcserver.c b/base/system/services/rpcserver.c
index 5bf4537c7d2..00503fc54ee 100644
--- a/base/system/services/rpcserver.c
+++ b/base/system/services/rpcserver.c
@@ -6715,10 +6715,16 @@ RControlServiceExW(
 /* Function 52 */
 DWORD
 WINAPI
-RSendPnPMessage(
-    handle_t BindingHandle)  /* FIXME */
+RI_ScSendPnPMessage(
+    _In_ RPC_SERVICE_STATUS_HANDLE hServiceStatus,
+    _In_ DWORD dwControl,
+    _In_ DWORD dwEventType,
+    _In_ DWORD dwEventSize,
+    _In_ LPBYTE pEventData)
 {
-    UNIMPLEMENTED;
+    DPRINT1("RI_ScSendPnPMessage(%p %lx %lu %lu %p)\n",
+            hServiceStatus, dwControl, dwEventType, dwEventSize, pEventData);
+
     return ERROR_CALL_NOT_IMPLEMENTED;
 }
 
diff --git a/dll/win32/advapi32/advapi32.h b/dll/win32/advapi32/advapi32.h
index 777f19eda63..8b3655e9e69 100644
--- a/dll/win32/advapi32/advapi32.h
+++ b/dll/win32/advapi32/advapi32.h
@@ -39,6 +39,8 @@
 #include <seclogon_c.h>
 #include <svcctl_c.h>
 #include <winreg_c.h>
+#include <dbt.h>
+// #include <winsvc_undoc.h>
 
 #include <wine/debug.h>
 #include <wine/unicode.h>
diff --git a/dll/win32/advapi32/advapi32.spec b/dll/win32/advapi32/advapi32.spec
index b684b09c4e3..4e6c86bea0f 100644
--- a/dll/win32/advapi32/advapi32.spec
+++ b/dll/win32/advapi32/advapi32.spec
@@ -306,6 +306,7 @@
 @ stdcall I_QueryTagInformation(ptr long ptr)
 @ stdcall I_ScIsSecurityProcess()
 @ stdcall I_ScPnPGetServiceName(ptr wstr long)
+@ stdcall I_ScSendPnPMessage(ptr long long ptr)
 @ stub I_ScSendTSMessage
 @ stdcall I_ScSetServiceBitsA(ptr long long long str)
 @ stdcall I_ScSetServiceBitsW(ptr long long long wstr)
diff --git a/dll/win32/advapi32/service/scm.c b/dll/win32/advapi32/service/scm.c
index aee23c5750d..0c3dd3d057e 100644
--- a/dll/win32/advapi32/service/scm.c
+++ b/dll/win32/advapi32/service/scm.c
@@ -1617,6 +1617,45 @@ EnumServicesStatusExW(SC_HANDLE hSCManager,
 }
 
 
+/**********************************************************************
+ *  I_ScSendPnPMessage
+ *
+ * Undocumented
+ *
+ * @unimplemented
+ */
+BOOL
+WINAPI
+I_ScSendPnPMessage(
+    _In_ SERVICE_STATUS_HANDLE hServiceStatus,
+    _In_ DWORD dwControlCode,
+    _In_ DWORD dwEventType,
+    _In_ PVOID pEventData)
+{
+    BOOL bResult;
+
+    TRACE("I_ScSendPnPMessage(%p %lu %lu %p)\n",
+          hServiceStatus, dwControlCode, dwEventType, pEventData);
+
+    RpcTryExcept
+    {
+        bResult = RI_ScSendPnPMessage((RPC_SERVICE_STATUS_HANDLE)hServiceStatus,
+                                       dwControlCode,
+                                       dwEventType,
+                                       ((PDEV_BROADCAST_HDR)pEventData)->dbch_size,
+                                       pEventData);
+    }
+    RpcExcept(EXCEPTION_EXECUTE_HANDLER)
+    {
+        SetLastError(ScmRpcStatusToWinError(RpcExceptionCode()));
+        bResult = FALSE;
+    }
+    RpcEndExcept;
+
+    return bResult;
+}
+
+
 /**********************************************************************
  *  GetServiceDisplayNameA
  *
diff --git a/sdk/include/reactos/idl/svcctl.idl b/sdk/include/reactos/idl/svcctl.idl
index c55eddf2aea..c018dfe1b0b 100644
--- a/sdk/include/reactos/idl/svcctl.idl
+++ b/sdk/include/reactos/idl/svcctl.idl
@@ -876,8 +876,12 @@ interface svcctl
     /* Function 52 */
     DWORD
     __stdcall
-    RSendPnPMessage(
-        [in] handle_t BindingHandle); /* FIXME */
+    RI_ScSendPnPMessage(
+        [in] RPC_SERVICE_STATUS_HANDLE hServiceStatus,
+        [in] DWORD dwControl,
+        [in] DWORD dwEventType,
+        [in] DWORD dwEventSize,
+        [in, size_is(dwEventSize)] LPBYTE pEventData);
 
     /* Function 53 */
     DWORD
diff --git a/sdk/include/reactos/winsvc_undoc.h b/sdk/include/reactos/winsvc_undoc.h
index d10ea767141..0363c2fbb12 100644
--- a/sdk/include/reactos/winsvc_undoc.h
+++ b/sdk/include/reactos/winsvc_undoc.h
@@ -60,7 +60,13 @@ I_ScPnPGetServiceName(
     _Out_ LPWSTR lpServiceName,
     _In_ DWORD cchServiceName);
 
-/* I_ScSendPnPMessage */
+DWORD
+WINAPI
+I_ScSendPnPMessage(
+    _In_ SERVICE_STATUS_HANDLE hServiceStatus,
+    _In_ DWORD dwControlCode,
+    _In_ DWORD dwEventType,
+    _In_ PVOID pEventData);
 
 /* I_ScSendTSMessage */