Scripting Windows Services
Delete a ServiceInstall a Service
List Antecedent Services for a Single Service
List Dependent Services for All Services
List Dependent Services for a Single Service
List Inactive Services
List Services that Can be Paused
List Services that Can be Stopped
List Service Load Order Groups
List Service Properties
List Services Running in All Processes
List Services Running in a Process
List Service Status
List Service Status Changes as recorded in the System Event Log
Monitor Changes in Service Status
Modify Service Accounts
Modify a Service Account Password
Modify Service Error Control Codes
Monitor Service Performance
Modify Service Start Options
Pause Services Running Under a Specific Account
Resume AutoStart Services that are Paused
Start AutoStart Services that have Stopped
Start a Service and Its Dependents
Stop a Service and Its Dependents
Stop Services Running Under a Specific Account
You can use any of the VBScript programs below in ActiveXperts Network Monitor. Click here for an explanation about how to include scripts in ActiveXperts Network Monitor.
Delete a Service
Removes a hypothetical service named DbService.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colListOfServices = objWMIService.ExecQuery _ ("Select * from Win32_Service Where Name = 'DbService'") For Each objService in colListOfServices objService.StopService() objService.Delete() Next
Install a Service
Installs a hypothetical service named Db.exe.
Const OWN_PROCESS = 16 Const NOT_INTERACTIVE = False Const NORMAL_ERROR_CONTROL = 2 strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set objService = objWMIService.Get("Win32_BaseService") errReturn = objService.Create("DbService" ,"Personnel Database" , _ "c:\windows\system32\db.exe", OWN_PROCESS, NORMAL_ERROR_CONTROL,_ "Manual", NOT_INTERACTIVE, "NT AUTHORITY\LocalService", "" )
List Antecedent Services for a Single Service
Lists all the services that must be running before the SMTP service can be started.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServiceList = objWMIService.ExecQuery("Associators of " _ & "{Win32_service.Name='SMTPSVC'} Where " _ & "AssocClass=Win32_DependentService " & "Role=Dependent") For Each objService in colServiceList Wscript.Echo objService.DisplayName Next
List Dependent Services for All Services
Enumerates dependent services for all the services installed on a computer and writes that information to a text file.
Const ForAppending = 8 Set objFSO = CreateObject("Scripting.FileSystemObject") Set objLogFile = _ objFSO.OpenTextFile("c:\scripts\service_dependencies.csv", _ ForAppending, True) objLogFile.Write("Service Dependencies") objLogFile.Writeline strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colListOfServices = objWMIService.ExecQuery _ ("Select * from Win32_Service") For Each objService in colListofServices objServiceRegistryName = objService.Name objServiceDisplayName = objService.DisplayName Set colServiceList = objWMIService.ExecQuery("Associators of " _ & "{Win32_Service.Name='" & objServiceRegistryName & "'} Where AssocClass=Win32_DependentService Role=Antecedent" ) If colServiceList.Count = 0 then objLogFile.Write(objServiceDisplayName) & ", None" objLogFile.Writeline Else For Each objDependentService in colServiceList objLogFile.Write(objServiceDisplayName) & "," objLogFile.Write(objDependentService.DisplayName) Next objLogFile.WriteLine End If Next objLogFile.Close
List Dependent Services for a Single Service
Enumerates all the services that cannot start until the Rasman service has started.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServiceList = objWMIService.ExecQuery("Associators of " _ & "{Win32_Service.Name='rasman'} Where " _ & "AssocClass=Win32_DependentService " & "Role=Antecedent" ) For Each objService in colServiceList Wscript.Echo objService.DisplayName Next
List Inactive Services
Returns a list of all the services installed on a computer that are currently stopped.
strComputer = "." Set objWMIService = GetObject("winmgmts:" & _ "{impersonationLevel=Impersonate}!\\" & strComputer & "\root\cimv2") Set colStoppedServices = objWMIService.ExecQuery _ ("Select * From Win32_Service Where State <> 'Running'") For Each objService in colStoppedServices Wscript.Echo objService.DisplayName & " = " & objService.State Next
List Services that Can be Paused
Returns a list of services that can be paused.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServices = objWMIService.ExecQuery _ ("Select * from Win32_Service Where AcceptPause = True") For Each objService in colServices Wscript.Echo objService.DisplayName Next
List Services that Can be Stopped
Returns a list of services that can be stopped.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServices = objWMIService.ExecQuery _ ("Select * from Win32_Service Where AcceptStop = True") For Each objService in colServices Wscript.Echo objService.DisplayName Next
List Service Load Order Groups
Returns a list of all the service load order groups found on a computer, and well as their load order.
On Error Resume Next strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colItems = objWMIService.ExecQuery("Select * from Win32_LoadOrderGroup") For Each objItem in colItems Wscript.Echo "Driver Enabled: " & objItem.DriverEnabled Wscript.Echo "Group Order: " & objItem.GroupOrder Wscript.Echo "Name: " & objItem.Name Wscript.Echo Next
List Service Properties
Retrieves a complete list of services and their associated properties. Information is saved to a text file: C:\Scripts\Service_List.cs.
Const ForAppending = 8 Set objFSO = CreateObject("Scripting.FileSystemObject") Set objLogFile = objFSO.OpenTextFile("c:\scripts\service_list.csv", _ ForAppending, True) objLogFile.Write _ ("System Name,Service Name,Service Type,Service State, Exit " _ & "Code,Process ID,Can Be Paused,Can Be Stopped,Caption," _ & "Description,Can Interact with Desktop,Display Name,Error " _ & "Control, Executable Path Name,Service Started," _ & "Start Mode,Account Name ") objLogFile.Writeline strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colListOfServices = objWMIService.ExecQuery _ ("Select * from Win32_Service") For Each objService in colListOfServices objLogFile.Write(objService.SystemName) & "," objLogFile.Write(objService.Name) & "," objLogFile.Write(objService.ServiceType) & "," objLogFile.Write(objService.State) & "," objLogFile.Write(objService.ExitCode) & "," objLogFile.Write(objService.ProcessID) & "," objLogFile.Write(objService.AcceptPause) & "," objLogFile.Write(objService.AcceptStop) & "," objLogFile.Write(objService.Caption) & "," objLogFile.Write(objService.Description) & "," objLogFile.Write(objService.DesktopInteract) & "," objLogFile.Write(objService.DisplayName) & "," objLogFile.Write(objService.ErrorControl) & "," objLogFile.Write(objService.PathName) & "," objLogFile.Write(objService.Started) & "," objLogFile.Write(objService.StartMode) & "," objLogFile.Write(objService.StartName) & "," objLogFile.writeline Next objLogFile.Close
List Services Running in All Processes
Returns a list of processes and all the services currently running in each process.
Set objIdDictionary = CreateObject("Scripting.Dictionary") strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServices = objWMIService.ExecQuery _ ("Select * from Win32_Service Where State <> 'Stopped'") For Each objService in colServices If objIdDictionary.Exists(objService.ProcessID) Then Else objIdDictionary.Add objService.ProcessID, objService.ProcessID End If Next colProcessIDs = objIdDictionary.Items For i = 0 to objIdDictionary.Count - 1 Set colServices = objWMIService.ExecQuery _ ("Select * from Win32_Service Where ProcessID = '" & _ colProcessIDs(i) & "'") Wscript.Echo "Process ID: " & colProcessIDs(i) For Each objService in colServices Wscript.Echo VbTab & objService.DisplayName Next Next
List Services Running in a Process
Returns a list of services running in the Services.exe process.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colListOfServices = objWMIService.ExecQuery _ ("Select * from Win32_Service Where " & _ "PathName = 'C:\WINDOWS\system32\services.exe'") For Each objService in colListOfServices Wscript.Echo objService.DisplayName Next
List Service Status
Returns a list of all the services installed on a computer, and indicates their current status (typically, running or not running).
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colRunningServices = objWMIService.ExecQuery("Select * from Win32_Service") For Each objService in colRunningServices Wscript.Echo objService.DisplayName & VbTab & objService.State Next
List Service Status Changes as recorded in the System Event Log
Retrieves events from the System event log that have an event ID of 7036. These events are recorded any time a service changes status.
Set dtmConvertedDate = CreateObject("WbemScripting.SWbemDateTime") strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServiceEvents = objWMIService.ExecQuery _ ("Select * from Win32_NTLogEvent Where Logfile = 'System' and " _ & "EventCode = '7036'") For Each strEvent in colServiceEvents dtmConvertedDate.Value = strEvent.TimeWritten Wscript.Echo dtmConvertedDate.GetVarDate Wscript.Echo strEvent.Message Next
Monitor Changes in Service Status
Temporary event consumer that issues an alert any time a service changes status (for example, an active service that is paused or stopped).
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServices = objWMIService. _ ExecNotificationQuery("Select * from __instancemodificationevent " _ & "within 30 where TargetInstance isa 'Win32_Service'") i = 0 Do While i = 0 Set objService = colServices.NextEvent If objService.TargetInstance.State <> _ objService.PreviousInstance.State Then Wscript.Echo objService.TargetInstance.Name _ & " is " & objService.TargetInstance.State _ & ". The service previously was " & _ objService.PreviousInstance.State & "." End If Loop
Modify Service Accounts
Changes the service account to LocalService for any services running under the hypothetical service account Netsvc.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServiceList = objWMIService.ExecQuery _ ("Select * from Win32_Service Where StartName = '.\netsvc'") For each objService in colServices errServiceChange = objService.Change _ ( , , , , , , "NT AUTHORITY\LocalService" , "") Next
Modify a Service Account Password
Changes the service account password for any services running under the hypothetical service account Netsvc.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServiceList = objWMIService.ExecQuery _ ("Select * from Win32_Service Where StartName = '.\netsvc'") For Each objService in colServiceList errReturn = objService.Change( , , , , , , , "password") Next
Modify Service Error Control Codes
Configures all auto-start services to issue an alert if the service fails during startup.
Const NORMAL_ERROR_CONTROL = 2 strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServiceList = objWMIService.ExecQuery _ ("Select * from Win32_Service where ErrorControl = 'Ignore'") For Each objService in colServiceList errReturn = objService.Change( , , , NORMAL_ERROR_CONTROL) Next
Monitor Service Performance
Uses formatted performance counters to retrieve performance data for the DHCP Server service.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") set objRefresher = CreateObject("WbemScripting.SWbemRefresher") Set colDHCPServer = objRefresher.AddEnum(objWMIService, _ "Win32_PerfFormattedData_DHCPServer_DHCPServer").ObjectSet objRefresher.Refresh For i = 1 to 60 For Each objDHCPServer in colDHCPServer Wscript.Echo "Acknowledgements per second: " & _ objDHCPServer.AcksPerSec Wscript.Echo "Declines per second: " & _ objDHCPServer.DeclinesPerSec Wscript.Echo "Discovers per second: " & _ objDHCPServer.DiscoversPerSec Wscript.Echo "Informs per second: " & objDHCPServer.InformsPerSec Wscript.Echo "Offers per second: " & objDHCPServer.OffersPerSec Wscript.Echo "Releases per second: " & _ objDHCPServer.ReleasesPerSec Wscript.Echo "Requests per second: " & _ objDHCPServer.RequestsPerSec Next Wscript.Sleep 10000 objRefresher.Refresh Next
Modify Service Start Options
Disables all services configured as manual start. Among other things, this prevents Power Users from being able to start these services.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServiceList = objWMIService.ExecQuery _ ("Select * from Win32_Service where StartMode = 'Manual'") For Each objService in colServiceList errReturnCode = objService.Change( , , , , "Disabled") Next
Pause Services Running Under a Specific Account
Pauses all services running under the hypothetical service account Netsvc.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServices = objWMIService.ExecQuery _ ("Select * from Win32_Service Where StartName = '.\netsvc'") For each objService in colServices errReturnCode = objService.PauseService() Next
Resume AutoStart Services that are Paused
Restarts any auto-start services that have been paused.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colListOfServices = objWMIService.ExecQuery _ ("Select * from Win32_Service Where State = 'Paused' and StartMode = 'Auto'") For Each objService in colListOfServices objService.ResumeService() Next
Start AutoStart Services that have Stopped
Restarts any auto-start services that have been stopped.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colListOfServices = objWMIService.ExecQuery _ ("Select * from Win32_Service Where State = 'Stopped' and StartMode = " _ & "'Auto'") For Each objService in colListOfServices objService.StartService() Next
Start a Service and Its Dependents
Starts the NetDDE service and all its dependent services.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServiceList = objWMIService.ExecQuery _ ("Select * from Win32_Service where Name='NetDDE'") For Each objService in colServiceList errReturn = objService.StartService() Next Wscript.Sleep 20000 Set colServiceList = objWMIService.ExecQuery("Associators of " _ & "{Win32_Service.Name='NetDDE'} Where " _ & "AssocClass=Win32_DependentService " & "Role=Dependent" ) For Each objService in colServiceList objService.StartService() Next
Stop a Service and Its Dependents
Stops the NetDDE service and all its dependent services.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServiceList = objWMIService.ExecQuery("Associators of " _ & "{Win32_Service.Name='NetDDE'} Where " _ & "AssocClass=Win32_DependentService " & "Role=Antecedent" ) For Each objService in colServiceList objService.StopService() Next Wscript.Sleep 20000 Set colServiceList = objWMIService.ExecQuery _ ("Select * from Win32_Service where Name='NetDDE'") For Each objService in colServiceList errReturn = objService.StopService() Next
Stop Services Running Under a Specific Account
Stops all services running under the hypothetical service account Netsvc.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServices = objWMIService.ExecQuery _ ("Select * from Win32_Service Where StartName = '.\netsvc'") For Each objService in colServices errReturnCode = objService.StopService() Next