The configuration file is %WinDir%\RemoteServiceManager.cfg.

After the installation the file is created with a single user (root:root is the default, can be changed during installation), and access limited to network 192.168.0.0/16 .

The default installation file is therefore:

PRT=40
IP=192.168.0.0/16
USER=ROOT
{
PASS=root
permit-all
can-reboot
can-list
}

Where:
PRT=N ; Is the tcp port on which the RSM daemon listens.
IP=X.X.X.X/M ; Is the IP range, in short form, from which access is allowed.
USER=NAME ; Defines the name of a user. Its properties are included in the following { }. Inside { } can be defined the following commands:
{
PASS=PW ; Where PW is the password for the user (case sensitive).
PERMIT=SRVCNAME ; Gives explicit permission to startup/shutdown the specified service (as written in the first column of the LIST command output)
DENY=SRVCNAME ; Explicitely denies permission to startup/shutdown the specified service to the user.
PERMIT-ALL ; Permits startup/shutdown to any service (eventually excluded the ones specified in DENY=SRVNAME).
DENY-ALL ; Denies startup/shutdown to any service (eventually excluded the ones specified in PERMIT=SRVNAME).
CAN-REBOOT ; The user can reboot the machine.
CAN-LIST ; The user can issue the LIST command in order to have a list of the available services.
}

Default configuration allows the root user to do everything (list, startup/shutdown of services and system reboot) on the host, telnetting to port 40 from an ip in the 192.168.0.0/16 network.

Once telnetted to the proper port and authenticated, the user can type various commands:
LIST <id|name> ; Lists one (specifying its ID or NAME) or all the services, with current status.
START <id|name> ; Starts the specified service.
STOP <id|name> ; Stops the specified service
RESTART <id|name> ; STOPs and STARTs the specified service.
REBOOT ; Reboots the machine (fast shutdown).
QUIT ; Logouts Remote Service Manager.
HELP ; Shows a brief help.

Remote Service Manager permits total control of a remote machine and therefore must be carefully deployed on production machines.

It's highly reccomended to modify the configuration in order to:
- Change the default port.
- Change the default username:password (IMPORTANT!).
- Limit the allowed IPs (IMPORTANT!).

Connection to the RSM service is in clear text, so it's reccomended to access to the host with RSM in a secure, crypted, way.
This can be done in various ways, for example:
- ssh to a host from which is started the connection to the RSM host.
- connect to the RSM host without crossing the Internet.
- connect to the RSM host via a VPN.

The configuration file should be readable only by Administrator.

And... don't worry, there're no backdoors.
RSM has been (fastly) developed for internal necessities and used in servers not public (or at least without the RSM port public).
Testing has been done mostly on the functionality and not on the security (buffer overflows could be possible, AFAWK).
Take it as it comes: an helpful method to remotely manage windows servers from a trusted source.
Not much more, nothing less.