PowerShell provides
two ways of scripting Windows services. For lists of services I employ
Get-WmiObject win32_service. However, when I want to deal with a
particular service I choose Get-Service
followed by nameOfService.
Our main mission is to produce a script which returns interrogates Windows services
and generates a list of selected properties. In particular, I want to group then count how many services
operate under each of the three 'StartName' accounts: LocalSystem, LocalNetwork and LocalService.
I also want to draw your attention, or remind you, of three useful
scripting techniques: 1)
`backtick for word-wrap. 2) | for Pipelining the output of a basic
instruction into a new command 3) How to control the output with
group-Object, and format-Table.
Let us start with a preliminary script which employs Get-Member to research
the properties of services. From
the resulting list we can compare the properties, and then decide whether to
choose Get-Service or Get-WmiObject win32_service to script a particular task.
# PowerShell script to compare: # Get-Service
with # Get-WmiObject win32_service # Author: Guy Thomas
# Version 1.6 May 2009 tested on PowerShell v2
Let us investigate StartName. This property reveals
that each service relies on one of three built-in security accounts: LocalSystem, LocalService and LocalNetwork.
Background research unearths that LocalSystem is the most powerful as it
accesses system security privileges, which are not available to the other two
accounts.
# Script to list the StartName values Get-WmiObject win32_service # Author: Guy Thomas
# Version 1.2 May 2009 tested on PowerShell v2
Note 1: Any problems, simplify the script to:
Get-WmiObject win32_service |format-table Name, StartName -auto
Note 2: The tiny backtick at the end of the line `
means the same PowerShell command continues on the next line. As with
many scripting languages, there is no automatic word-wrap, thus end-of-line
normally means that the command terminates, the backtick extends the
commands to the next line.
Trap: With
Backtick: beware, there must be no space after the
`backtick.
Note 3: You could add this pipeline to refine the
command to include only "Running" services: | Where-Object {$_.state -eq
"Running"} `
Windows Management Instrumentation (WMI) is one of the hidden
treasures of Microsoft operating systems. Fortunately, Solarwinds
have created a
Free WMI Monitor so that you can discover these gems of performance
information, and thus improve your PowerShell scripts. Take the guess work out of which WMI counters to use when scripting the
operating system, Active Directory or Exchange Server.
Here is where pipelining comes into its own. Once we get a simple
command working, then we refine the output by piping the output into a new
command. I once thought that there was a limit of three such pipes;
however, I have successfully tested a chain of 5. I have to say that
beyond 3 pipes and the script gets a bit complicated for my liking.
# Script to list the StartName values Get-WmiObject win32_service # Author: Guy Thomas
# Version 1.2 May 2009 tested on PowerShell v2
Note 1: The above script incorporates a filter.
Talking of filters, my friend 'Mad' Mick says that -filter "state =
'running'" is superior to | Where {$_.state -eq "Running"} ` Do you know, I think Mick is right, -filter is better than where-object in
this case.
Note 2: Strictly speaking, I should use
where-Object rather than plain 'Where'. However PowerShell is
forgiving, and providing there is no ambiguity it uses its built-in aliases
for the shortened forms. For instance you could use 'group' rather than
group-Object.
# Script to list the StartName values Get-WmiObject win32_service # Author: Guy Thomas
# Version 1.2 May 2009 tested on PowerShell v2
Guy Recommends: Solarwinds' Log & Event Management Tool
LEM will alert you to problems such as when a key
application on a particular server is unavailable. It can also
detect when services have stopped, or if there is a
network latency problem. Perhaps this log and event management
tool's most interesting ability is to take corrective action, for
example by
restarting services, or isolating the source of a maleware attack.
Yet perhaps the killer reason why people
use LEM is for its
compliance capability, with a little help from you, it will ensure that your organization complies with industry
standards such as CISP or FERPA. LEM is a really smart
application that can make correlations between data in different logs,
then use its built-in logic to take corrective action, to restart services,
or thwart potential security breaches.
There are numerous PowerShell authors who have more scripting
knowledge than I, but none seem to share my penchant for comparing
what I see in the Windows utility with the output of a script. In
this instance I recommend launching Services.msc so that we can
make comparisons between the GUI and the results of my PowerShell services script.
Firstly, this GUI always surprises me with the sheer number of
services; moreover, each successive version of Windows spawns yet
more services. Secondly, be aware that the 'Name' column in the
GUI corresponds to the 'Caption' property when you use
win32_service. Furthermore 'Log on As' corresponds to 'StartName' in
the script.
Out-file
If I could digress and hark back to the verbosity of VBScript; because it took so much code to list the services, I feared that it would confuse beginners if I added another 10 lines of VBScript in order to output the list of services to
a text file. With PowerShell there is no such worry, all you need to store the results is to append these few words: | out-file "D:\PowerShell\Scripts\services.txt"
# Script to list the StartName values Get-WmiObject win32_service #
Author: Guy Thomas # Version 1.2 May 2009 tested on PowerShell v2
Get-WmiObject win32_service -filter "state = 'running' " ` | sort
StartName | group-object -Property StartName ` | format-table Name, Count
-auto | out-file "D:\PowerShell\Scripts\services.txt"
»
Summary of Scripting Services with PowerShell
My main point is that there are two methods for scripting PowerShell services.
Plain Get-Service has fewer properties than the WMI alternative. From
a practical point of view, these scripts show you how to group and count the
local accounts under which, the Windows services operate. Tip, where
possible observe the built-in GUI alongside your PowerShell script, in this
case launch Services.msc and make comparisons between the GUI's columns and
PowerShell's properties.
If you like this page then please share it with your friends
See more PowerShell examples of process and service
Please email me if you have a better example script. Also please report any factual mistakes, grammatical errors or broken links, I will be happy to correct the fault.
Windows Management Instrumentation (WMI) is one of the hidden
treasures of Microsoft operating systems.
Fortunately, Solarwinds
have created the
Free WMI Monitor so that you can actually see and understand these gems of
performance information. Take the guess work out of which
WMI counters to use for applications like Microsoft Active Directory,
SQL or Exchange Server.
