diff --git a/reactos/base/system/services/rpcserver.c b/reactos/base/system/services/rpcserver.c
index 92be3aa5a1c..77baac1c323 100644
--- a/reactos/base/system/services/rpcserver.c
+++ b/reactos/base/system/services/rpcserver.c
@@ -2475,7 +2475,7 @@ DWORD ROpenServiceA(
 DWORD RQueryServiceConfigA(
     handle_t BindingHandle,
     SC_RPC_HANDLE hService,
-    LPQUERY_SERVICE_CONFIGA lpServiceConfig,
+    LPBYTE lpBuf, //LPQUERY_SERVICE_CONFIGA lpServiceConfig,
     DWORD cbBufSize,
     LPBOUNDED_DWORD_8K pcbBytesNeeded)
 {
diff --git a/reactos/dll/win32/advapi32/service/scm.c b/reactos/dll/win32/advapi32/service/scm.c
index 61105fb835f..8e93b16cc36 100644
--- a/reactos/dll/win32/advapi32/service/scm.c
+++ b/reactos/dll/win32/advapi32/service/scm.c
@@ -1461,7 +1461,7 @@ QueryServiceConfigA(SC_HANDLE hService,
     /* Call to services.exe using RPC */
     dwError = RQueryServiceConfigA(BindingHandle,
                                    (SC_RPC_HANDLE)hService,
-                                   lpServiceConfig,
+                                   (LPBYTE)lpServiceConfig,
                                    cbBufSize,
                                    pcbBytesNeeded);
     if (dwError != ERROR_SUCCESS)
diff --git a/reactos/include/reactos/idl/svcctl.idl b/reactos/include/reactos/idl/svcctl.idl
index 761ecc135a1..2f737a5a489 100644
--- a/reactos/include/reactos/idl/svcctl.idl
+++ b/reactos/include/reactos/idl/svcctl.idl
@@ -578,7 +578,8 @@ interface svcctl
     DWORD RQueryServiceConfigA(
         [in] handle_t BindingHandle,
         [in] SC_RPC_HANDLE hService,
-        [out] LPQUERY_SERVICE_CONFIGA lpServiceConfig,
+        [out, unique, size_is(cbBufSize)] LPBYTE lpServiceConfig,
+        /* FIXME: should be [out] LPQUERY_SERVICE_CONFIGA lpServiceConfig, */
         [in, range(0, 1024*8)] DWORD cbBufSize,
         [out] LPBOUNDED_DWORD_8K pcbBytesNeeded);