ActiveXperts Network Monitor
Monitor servers, workstations, devices and applications in your network

Quicklinks

Scripting Windows Services

Delete a Service
Install a Service
List Antecedent Services for a Single Service
List Dependent Services for All Services
List Dependent Services for a Single Service
List Inactive Services
List Services that Can be Paused
List Services that Can be Stopped
List Service Load Order Groups
List Service Properties
List Services Running in All Processes
List Services Running in a Process
List Service Status
List Service Status Changes as recorded in the System Event Log
Monitor Changes in Service Status
Modify Service Accounts
Modify a Service Account Password
Modify Service Error Control Codes
Monitor Service Performance
Modify Service Start Options
Pause Services Running Under a Specific Account
Resume AutoStart Services that are Paused
Start AutoStart Services that have Stopped
Start a Service and Its Dependents
Stop a Service and Its Dependents
Stop Services Running Under a Specific Account

You can use any of the VBScript programs below in ActiveXperts Network Monitor. Click here for an explanation about how to include scripts in ActiveXperts Network Monitor.


Delete a Service


Removes a hypothetical service named DbService.
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colListOfServices = objWMIService.ExecQuery _
    ("Select * from Win32_Service Where Name = 'DbService'")

For Each objService in colListOfServices
    objService.StopService()
    objService.Delete()
Next

Install a Service


Installs a hypothetical service named Db.exe. 
Const OWN_PROCESS = 16
Const NOT_INTERACTIVE = False
Const NORMAL_ERROR_CONTROL = 2

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set objService = objWMIService.Get("Win32_BaseService")

errReturn = objService.Create("DbService" ,"Personnel Database" , _
    "c:\windows\system32\db.exe", OWN_PROCESS, NORMAL_ERROR_CONTROL,_
        "Manual", NOT_INTERACTIVE, "NT AUTHORITY\LocalService", ""  )

List Antecedent Services for a Single Service


Lists all the services that must be running before the SMTP service can be started. 
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colServiceList = objWMIService.ExecQuery("Associators of " _ 
     & "{Win32_service.Name='SMTPSVC'} Where " _
         & "AssocClass=Win32_DependentService " & "Role=Dependent")   
     
For Each objService in colServiceList
    Wscript.Echo objService.DisplayName 
Next

List Dependent Services for All Services


Enumerates dependent services for all the services installed on a computer and writes that information to a text file. 
Const ForAppending = 8
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objLogFile = _
     objFSO.OpenTextFile("c:\scripts\service_dependencies.csv", _
         ForAppending, True)
objLogFile.Write("Service Dependencies") 
objLogFile.Writeline

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colListOfServices = objWMIService.ExecQuery _
    ("Select * from Win32_Service")
 
For Each objService in colListofServices
    objServiceRegistryName = objService.Name
    objServiceDisplayName = objService.DisplayName
 
Set colServiceList = objWMIService.ExecQuery("Associators of " _
   & "{Win32_Service.Name='" & objServiceRegistryName & "'} Where AssocClass=Win32_DependentService Role=Antecedent" )
 
 
 If colServiceList.Count = 0 then
        objLogFile.Write(objServiceDisplayName) & ", None"
        objLogFile.Writeline
    Else
        For Each objDependentService in colServiceList         
            objLogFile.Write(objServiceDisplayName) & ","
            objLogFile.Write(objDependentService.DisplayName)  
        Next 
        objLogFile.WriteLine
    End If
Next
objLogFile.Close

List Dependent Services for a Single Service


Enumerates all the services that cannot start until the Rasman service has started.
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colServiceList = objWMIService.ExecQuery("Associators of " _
    & "{Win32_Service.Name='rasman'} Where " _
        & "AssocClass=Win32_DependentService " & "Role=Antecedent" )

For Each objService in colServiceList
    Wscript.Echo objService.DisplayName 
Next

List Inactive Services


Returns a list of all the services installed on a computer that are currently stopped. 
strComputer = "."
Set objWMIService = GetObject("winmgmts:" & _
    "{impersonationLevel=Impersonate}!\\" & strComputer & "\root\cimv2")

Set colStoppedServices = objWMIService.ExecQuery _
    ("Select * From Win32_Service Where State <> 'Running'")
 
For Each objService in colStoppedServices
    Wscript.Echo objService.DisplayName  & " = " & objService.State
Next

List Services that Can be Paused


Returns a list of services that can be paused. 
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colServices = objWMIService.ExecQuery _
    ("Select * from Win32_Service Where AcceptPause = True")

For Each objService in colServices
    Wscript.Echo objService.DisplayName 
Next

List Services that Can be Stopped


Returns a list of services that can be stopped. 
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colServices = objWMIService.ExecQuery _
    ("Select * from Win32_Service Where AcceptStop = True")

For Each objService in colServices
    Wscript.Echo objService.DisplayName 
Next

List Service Load Order Groups


Returns a list of all the service load order groups found on a computer, and well as their load order. 
On Error Resume Next

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colItems = objWMIService.ExecQuery("Select * from Win32_LoadOrderGroup")

For Each objItem in colItems
    Wscript.Echo "Driver Enabled: " & objItem.DriverEnabled
    Wscript.Echo "Group Order: " & objItem.GroupOrder
    Wscript.Echo "Name: " & objItem.Name
    Wscript.Echo
Next

List Service Properties


Retrieves a complete list of services and their associated properties. Information is saved to a text file: C:\Scripts\Service_List.cs. 
Const ForAppending = 8
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objLogFile = objFSO.OpenTextFile("c:\scripts\service_list.csv", _ 
    ForAppending, True)

objLogFile.Write _
    ("System Name,Service Name,Service Type,Service State, Exit " _ 
        & "Code,Process ID,Can Be Paused,Can Be Stopped,Caption," _ 
        & "Description,Can Interact with Desktop,Display Name,Error " _
        & "Control, Executable Path Name,Service Started," _ 
        & "Start Mode,Account Name ") 
objLogFile.Writeline

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colListOfServices = objWMIService.ExecQuery _
        ("Select * from Win32_Service")

For Each objService in colListOfServices
    objLogFile.Write(objService.SystemName) & "," 
    objLogFile.Write(objService.Name) & "," 
    objLogFile.Write(objService.ServiceType) & "," 
    objLogFile.Write(objService.State) & "," 
    objLogFile.Write(objService.ExitCode) & "," 
    objLogFile.Write(objService.ProcessID) & "," 
    objLogFile.Write(objService.AcceptPause) & "," 
    objLogFile.Write(objService.AcceptStop) & "," 
    objLogFile.Write(objService.Caption) & "," 
    objLogFile.Write(objService.Description) & "," 
    objLogFile.Write(objService.DesktopInteract) & "," 
    objLogFile.Write(objService.DisplayName) & "," 
    objLogFile.Write(objService.ErrorControl) & "," 
    objLogFile.Write(objService.PathName) & "," 
    objLogFile.Write(objService.Started) & "," 
    objLogFile.Write(objService.StartMode) & "," 
    objLogFile.Write(objService.StartName) & "," 
    objLogFile.writeline
Next
objLogFile.Close

List Services Running in All Processes


Returns a list of processes and all the services currently running in each process. 
Set objIdDictionary = CreateObject("Scripting.Dictionary")

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colServices = objWMIService.ExecQuery _
    ("Select * from Win32_Service Where State <> 'Stopped'")

For Each objService in colServices
    If objIdDictionary.Exists(objService.ProcessID) Then
    Else
        objIdDictionary.Add objService.ProcessID, objService.ProcessID
    End If
Next

colProcessIDs = objIdDictionary.Items

For i = 0 to objIdDictionary.Count - 1
    Set colServices = objWMIService.ExecQuery _
        ("Select * from Win32_Service Where ProcessID = '" & _
            colProcessIDs(i) & "'")
    Wscript.Echo "Process ID: " & colProcessIDs(i)
    For Each objService in colServices
        Wscript.Echo VbTab & objService.DisplayName 
    Next
Next

List Services Running in a Process


Returns a list of services running in the Services.exe process. 
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colListOfServices = objWMIService.ExecQuery _
    ("Select * from Win32_Service Where " & _
        "PathName = 'C:\WINDOWS\system32\services.exe'")

For Each objService in colListOfServices
    Wscript.Echo objService.DisplayName
Next

List Service Status


Returns a list of all the services installed on a computer, and indicates their current status (typically, running or not running).
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colRunningServices = objWMIService.ExecQuery("Select * from Win32_Service")

For Each objService in colRunningServices 
    Wscript.Echo objService.DisplayName  & VbTab & objService.State
Next

List Service Status Changes as recorded in the System Event Log


Retrieves events from the System event log that have an event ID of 7036. These events are recorded any time a service changes status. 
Set dtmConvertedDate = CreateObject("WbemScripting.SWbemDateTime")

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colServiceEvents = objWMIService.ExecQuery _
    ("Select * from Win32_NTLogEvent Where Logfile = 'System' and " _
        & "EventCode = '7036'")

For Each strEvent in colServiceEvents
    dtmConvertedDate.Value = strEvent.TimeWritten
    Wscript.Echo dtmConvertedDate.GetVarDate    
    Wscript.Echo strEvent.Message
Next

Monitor Changes in Service Status


Temporary event consumer that issues an alert any time a service changes status (for example, an active service that is paused or stopped). 
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colServices = objWMIService. _ 
    ExecNotificationQuery("Select * from __instancemodificationevent " _ 
        & "within 30 where TargetInstance isa 'Win32_Service'")
i = 0

Do While i = 0
    Set objService = colServices.NextEvent
    If objService.TargetInstance.State <> _ 
        objService.PreviousInstance.State Then
        Wscript.Echo objService.TargetInstance.Name _ 
            &  " is " & objService.TargetInstance.State _
                & ". The service previously was " & _
                    objService.PreviousInstance.State & "."
    End If
Loop

Modify Service Accounts


Changes the service account to LocalService for any services running under the hypothetical service account Netsvc.
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colServiceList = objWMIService.ExecQuery _
    ("Select * from Win32_Service Where StartName = '.\netsvc'")

For each objService in colServices
    errServiceChange = objService.Change _
        ( , , , , , , "NT AUTHORITY\LocalService" , "")  
Next

Modify a Service Account Password


Changes the service account password for any services running under the hypothetical service account Netsvc.
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colServiceList = objWMIService.ExecQuery _
    ("Select * from Win32_Service Where StartName = '.\netsvc'")

For Each objService in colServiceList
    errReturn = objService.Change( , , , , , , , "password")  
Next

Modify Service Error Control Codes


Configures all auto-start services to issue an alert if the service fails during startup. 
Const NORMAL_ERROR_CONTROL = 2

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colServiceList = objWMIService.ExecQuery _
    ("Select * from Win32_Service where ErrorControl = 'Ignore'")

For Each objService in colServiceList
    errReturn = objService.Change( , , , NORMAL_ERROR_CONTROL)   
Next

Monitor Service Performance


Uses formatted performance counters to retrieve performance data for the DHCP Server service.
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

set objRefresher = CreateObject("WbemScripting.SWbemRefresher")
Set colDHCPServer = objRefresher.AddEnum(objWMIService, _
    "Win32_PerfFormattedData_DHCPServer_DHCPServer").ObjectSet
objRefresher.Refresh

For i = 1 to 60
    For Each objDHCPServer in colDHCPServer
        Wscript.Echo "Acknowledgements per second: " & _
            objDHCPServer.AcksPerSec
        Wscript.Echo "Declines per second: " & _
            objDHCPServer.DeclinesPerSec
        Wscript.Echo "Discovers per second: " & _
            objDHCPServer.DiscoversPerSec
        Wscript.Echo "Informs per second: " & objDHCPServer.InformsPerSec
        Wscript.Echo "Offers per second: " & objDHCPServer.OffersPerSec
        Wscript.Echo "Releases per second: " & _
            objDHCPServer.ReleasesPerSec
        Wscript.Echo "Requests per second: " & _
            objDHCPServer.RequestsPerSec
    Next
    Wscript.Sleep 10000
    objRefresher.Refresh
Next

Modify Service Start Options


Disables all services configured as manual start. Among other things, this prevents Power Users from being able to start these services.
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colServiceList = objWMIService.ExecQuery _
    ("Select * from Win32_Service where StartMode = 'Manual'")

For Each objService in colServiceList
    errReturnCode = objService.Change( , , , , "Disabled")   
Next

Pause Services Running Under a Specific Account


Pauses all services running under the hypothetical service account Netsvc.
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colServices = objWMIService.ExecQuery _
    ("Select * from Win32_Service Where StartName = '.\netsvc'")

For each objService in colServices 
    errReturnCode = objService.PauseService()
Next

Resume AutoStart Services that are Paused


Restarts any auto-start services that have been paused. 
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colListOfServices = objWMIService.ExecQuery _
 ("Select * from Win32_Service Where State = 'Paused' and StartMode = 'Auto'")

For Each objService in colListOfServices
    objService.ResumeService()
Next

Start AutoStart Services that have Stopped


Restarts any auto-start services that have been stopped.
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colListOfServices = objWMIService.ExecQuery _
    ("Select * from Win32_Service Where State = 'Stopped' and StartMode = " _
        & "'Auto'")

For Each objService in colListOfServices
    objService.StartService()
Next

Start a Service and Its Dependents


Starts the NetDDE service and all its dependent services. 
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colServiceList = objWMIService.ExecQuery _
    ("Select * from Win32_Service where Name='NetDDE'")

For Each objService in colServiceList
    errReturn = objService.StartService()
Next

Wscript.Sleep 20000

Set colServiceList = objWMIService.ExecQuery("Associators of " _
   & "{Win32_Service.Name='NetDDE'} Where " _
        & "AssocClass=Win32_DependentService " & "Role=Dependent" )
For Each objService in colServiceList
    objService.StartService()
Next

Stop a Service and Its Dependents


Stops the NetDDE service and all its dependent services. 
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colServiceList = objWMIService.ExecQuery("Associators of " _
    & "{Win32_Service.Name='NetDDE'} Where " _
        & "AssocClass=Win32_DependentService " & "Role=Antecedent" )

For Each objService in colServiceList
    objService.StopService()
Next

Wscript.Sleep 20000

Set colServiceList = objWMIService.ExecQuery _
        ("Select * from Win32_Service where Name='NetDDE'")
For Each objService in colServiceList
    errReturn = objService.StopService()
Next

Stop Services Running Under a Specific Account


Stops all services running under the hypothetical service account Netsvc. 
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colServices = objWMIService.ExecQuery _
    ("Select * from Win32_Service Where StartName = '.\netsvc'")

For Each objService in colServices 
    errReturnCode = objService.StopService()
Next