Scripts to manage Services
Changing a Service Account PasswordConfiguring Service Error Control Codes
Configuring Service Start Options
Determining Services that can be Paused
Determining Services Running in All Processes
Determining Services Running in a Process
Determining Services that can be Stopped
Enumerating Antecedent Services for a Single Service
Enumerating Dependent Services for All Services
Enumerating Dependent Services for a Single Service
Enumerating Inactive Services
Enumerating Service Load Order Groups
Installing a Service
Monitoring Service Performance
Pausing Services Running Under a Specific Account
Removing a Service
Resuming AutoStart Services that are Paused
Retrieving Service Properties
Retrieving Service Status
Retrieving Service Status Changes from Event Logs
Starting AutoStart Services that have Stopped
Starting a Service and Its Dependents
Stopping a Service and Its Dependents
Stopping Services Running Under a Specific Account
Switching Service Accounts to Local Service
Changing a Service Account Password
Changes the service account password for any services running under the hypothetical service account Netsvc.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServiceList = objWMIService.ExecQuery _ ("Select * from Win32_Service") For Each objservice in colServiceList If objService.Startname = ".\netsvc" Then errReturn = objService.Change( , , , , , , , "password") End If Next
Configuring Service Error Control Codes
Configures all auto-start services to issue an alert if the service fails during startup.
Const NORMAL_ERROR_CONTROL = 2 strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServiceList = objWMIService.ExecQuery _ ("Select * from Win32_Service where ErrorControl = 'Ignore'") For Each objService in colServiceList errReturn = objService.Change( , , , NORMAL_ERROR_CONTROL) Next
Configuring Service Start Options
Disables all services configured as manual start. Among other things, this prevents Power Users from being able to start these services.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServiceList = objWMIService.ExecQuery _ ("Select * from Win32_Service where StartMode = 'Manual'") For Each objService in colServiceList errReturnCode = objService.Change( , , , , "Disabled") Next
Determining Services that can be Paused
Returns a list of services that can be stopped.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServices = objWMIService.ExecQuery _ ("Select * from Win32_Service Where AcceptPause = True") For Each objService in colServices Wscript.Echo objService.DisplayName Next
Determining Services Running in All Processes
Returns a list of processes and all the services currently running in each process.
set objIdDictionary = CreateObject("Scripting.Dictionary") strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServices = objWMIService.ExecQuery _ ("Select * from Win32_Service Where State <> 'Stopped'") For Each objService in colServices If objIdDictionary.Exists(objService.ProcessID) Then Else objIdDictionary.Add objService.ProcessID, objService.ProcessID End If Next colProcessIDs = objIdDictionary.Items For i = 0 to objIdDictionary.Count - 1 Set colServices = objWMIService.ExecQuery _ ("Select * from Win32_Service Where ProcessID = '" & _ colProcessIDs(i) & "'") Wscript.Echo "Process ID: " & colProcessIDs(i) For Each objService in colServices Wscript.Echo VbTab & objService.DisplayName Next Next
Determining Services Running in a Process
Returns a list of services running in the Services.exe process.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colListOfServices = objWMIService.ExecQuery _ ("Select * from Win32_Service") For Each objService in colListOfServices If objService.PathName = "C:\WINDOWS\system32\services.exe" Then Wscript.Echo objService.DisplayName End If Next
Determining Services that can be Stopped
Returns a list of services that can be stopped.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServices = objWMIService.ExecQuery _ ("Select * from Win32_Service Where AcceptStop = True") For Each objService in colServices Wscript.Echo objService.DisplayName Next
Enumerating Antecedent Services for a Single Service
Enumerates all the services that must be running before the SMTP service can be started.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServiceList = objWMIService.ExecQuery("Associators of " _ & "{Win32_service.Name='SMTPSVC'} Where " _ & "AssocClass=Win32_DependentService " & "Role=Dependent") For Each objService in colServiceList Wscript.Echo objService.DisplayName Next
Enumerating Dependent Services for All Services
Returns a list of all the services installed on a computer that are currently stopped.
Const ForAppending = 8 Set objFSO = CreateObject("Scripting.FileSystemObject") Set objLogFile = _ objFSO.OpenTextFile("c:\scripts\service_dependencies.csv", _ ForAppending, True) objLogFile.Write("Service Dependencies") objLogFile.Writeline strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colListOfServices = objWMIService.ExecQuery _ ("Select * from Win32_Service") For Each objService in colListofServices objServiceRegistryName = objService.Name objServiceDisplayName = objService.DisplayName Set colServiceList = objWMIService.ExecQuery("Associators of " _ & "{Win32_Service.Name='" & objServiceRegistryName & "'} Where " & _ "AssocClass=Win32_DependentService Role=Antecedent" ) If colServiceList.Count = 0 then objLogFile.Write(objServiceDisplayName) & ", None" objLogFile.Writeline Else For Each objDependentService in colServiceList objLogFile.Write(objServiceDisplayName) & "," objLogFile.Write(objDependentService.DisplayName) Next objLogFile.WriteLine End If Next objLogFile.Close
Enumerating Dependent Services for a Single Service
Enumerates all the services that cannot start until the Rasman service has started.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServiceList = objWMIService.ExecQuery("Associators of " _ & "{Win32_Service.Name='rasman'} Where " _ & "AssocClass=Win32_DependentService " & "Role=Antecedent" ) For Each objService in colServiceList Wscript.Echo objService.DisplayName Next
Enumerating Inactive Services
Returns a list of all the services installed on a computer that are currently stopped.
strComputer = "." Set objWMIService = GetObject("winmgmts:" & _ "{impersonationLevel=Impersonate}!\\" & strComputer & "\root\cimv2") Set colStoppedServices = objWMIService.ExecQuery _ ("SELECT DisplayName,State FROM Win32_Service WHERE State <> 'Running'") For Each objService in colStoppedServices Wscript.Echo objService.DisplayName & " = " & objService.State Next
Enumerating Service Load Order Groups
Returns a list of all the service load order groups found on a computer, and well as their load order.
On Error Resume Next strComputer = "." Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2") Set colItems = objWMIService.ExecQuery("Select * from Win32_LoadOrderGroup") For Each objItem in colItems Wscript.Echo "Driver Enabled: " & objItem.DriverEnabled Wscript.Echo "Group Order: " & objItem.GroupOrder Wscript.Echo "Name: " & objItem.Name Wscript.Echo Next
Installing a Service
Installs a hypothetical service Db.exe.
Const OWN_PROCESS = 16 Const NOT_INTERACTIVE = False Const NORMAL_ERROR_CONTROL = 2 strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set objService = objWMIService.Get("Win32_BaseService") errReturn = objService.Create("DbService" ,"Personnel Database" , _ "c:\windows\system32\db.exe", OWN_PROCESS, NORMAL_ERROR_CONTROL, "Manual", _ NOT_INTERACTIVE, "NT AUTHORITY\LocalService", "" ) Wscript.Echo errReturn
Monitoring Service Performance
Uses formatted performance counters to retrieve performance data for the DHCP Server service.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") set objRefresher = CreateObject("WbemScripting.SWbemRefresher") Set colDHCPServer = objRefresher.AddEnum _ (objWMIService, "win32_PerfFormattedData_DHCPServer_DHCPServer"). _ ObjectSet objRefresher.Refresh For i = 1 to 60 For Each objDHCPServer in colDHCPServer Wscript.Echo "Acknowledgements per second: " & _ objDHCPServer.AcksPerSec Wscript.Echo "Declines per second: " & _ objDHCPServer.DeclinesPerSec Wscript.Echo "Discovers per second: " & _ objDHCPServer.DiscoversPerSec Wscript.Echo "Informs per second: " & objDHCPServer.InformsPerSec Wscript.Echo "Offers per second: " & objDHCPServer.OffersPerSec Wscript.Echo "Releases per second: " & _ objDHCPServer.ReleasesPerSec Wscript.Echo "Requests per second: " & _ objDHCPServer.RequestsPerSec Next Wscript.Sleep 10000 objRefresher.Refresh Next
Pausing Services Running Under a Specific Account
Pauses all services running under the hypothetical service account Netsvc.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServices = objWMIService.ExecQuery _ ("Select * from Win32_Service") For each objService in colServices If objService.StartName = ".\netsvc" Then errReturnCode = objService.PauseService() End If Next
Removing a Service
Removes a hypothetical service named DbService.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colListOfServices = objWMIService.ExecQuery _ ("Select * from Win32_Service Where Name = 'DbService'") For Each objService in colListOfServices objService.StopService() objService.Delete() Next
Resuming AutoStart Services that are Paused
Restarts any auto-start services that have been paused.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colListOfServices = objWMIService.ExecQuery _ ("Select * from Win32_Service Where State = 'Paused' and StartMode = 'Auto'") For Each objService in colListOfServices objService.ResumeService() Next
Retrieving Service Properties
Retrieves a complete list of services and their associated properties. Information is saved to a text file: C:\Scripts\Service_List.cs.
Const ForAppending = 8 Set objFSO = CreateObject("Scripting.FileSystemObject") Set objLogFile = objFSO.OpenTextFile("c:\scripts\service_list.csv", _ ForAppending, True) objLogFile.Write _ ("System Name,Service Name,Service Type,Service State, Exit " _ & "Code,Process ID,Can Be Paused,Can Be Stopped,Caption," _ & "Description,Can Interact with Desktop,Display Name,Error " _ & "Control, Executable Path Name,Service Started," _ & "Start Mode,Account Name ") objLogFile.Writeline strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colListOfServices = objWMIService.ExecQuery _ ("Select * from Win32_Service") For Each objService in colListOfServices objLogFile.Write(objService.SystemName) & "," objLogFile.Write(objService.Name) & "," objLogFile.Write(objService.ServiceType) & "," objLogFile.Write(objService.State) & "," objLogFile.Write(objService.ExitCode) & "," objLogFile.Write(objService.ProcessID) & "," objLogFile.Write(objService.AcceptPause) & "," objLogFile.Write(objService.AcceptStop) & "," objLogFile.Write(objService.Caption) & "," objLogFile.Write(objService.Description) & "," objLogFile.Write(objService.DesktopInteract) & "," objLogFile.Write(objService.DisplayName) & "," objLogFile.Write(objService.ErrorControl) & "," objLogFile.Write(objService.PathName) & "," objLogFile.Write(objService.Started) & "," objLogFile.Write(objService.StartMode) & "," objLogFile.Write(objService.StartName) & "," objLogFile.writeline Next objLogFile.Close
Retrieving Service Status
Returns a list of all the services installed on a computer, and indicates their current status (typically, running or not running).
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colRunningServices = objWMIService.ExecQuery _ ("Select * from Win32_Service") For Each objService in colRunningServices Wscript.Echo objService.DisplayName & VbTab & objService.State Next
Retrieving Service Status Changes from Event Logs
Retrieves events from the System event log that have an event ID of 7036. These events are recorded any time a service changes status.
Set dtmConvertedDate = CreateObject("WbemScripting.SWbemDateTime") strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServiceEvents = objWMIService.ExecQuery _ ("Select * from Win32_NTLogEvent Where Logfile = 'System' and " _ & "EventCode = '7036'") For Each strEvent in colServiceEvents dtmConvertedDate.Value = strEvent.TimeWritten Wscript.Echo dtmConvertedDate.GetVarDate Wscript.Echo strEvent.Message Next
Starting AutoStart Services that have Stopped
Restarts any auto-start services that have been stopped.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colListOfServices = objWMIService.ExecQuery _ ("Select * from Win32_Service Where State = 'Stopped' and StartMode = " _ & "'Auto'") For Each objService in colListOfServices objService.StartService() Next
Starting a Service and Its Dependents
Starts the NetDDE service and all its dependent services.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServiceList = objWMIService.ExecQuery _ ("Select * from Win32_Service where Name='NetDDE'") For each objService in colServiceList errReturn = objService.StartService() Next Wscript.Sleep 20000 Set colServiceList = objWMIService.ExecQuery("Associators of " _ & "{Win32_Service.Name='NetDDE'} Where " _ & "AssocClass=Win32_DependentService " & "Role=Dependent" ) For each objService in colServiceList objService.StartService() Next
Stopping a Service and Its Dependents
Stops the NetDDE service and all its dependent services.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServiceList = objWMIService.ExecQuery("Associators of " _ & "{Win32_Service.Name='NetDDE'} Where " _ & "AssocClass=Win32_DependentService " & "Role=Antecedent" ) For each objService in colServiceList objService.StopService() Next Wscript.Sleep 20000 Set colServiceList = objWMIService.ExecQuery _ ("Select * from Win32_Service where Name='NetDDE'") For each objService in colServiceList errReturn = objService.StopService() Next
Stopping Services Running Under a Specific Account
Stops all services running under the hypothetical service account Netsvc.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServices = objWMIService.ExecQuery _ ("Select * from win32_Service") For each objService in colServices If objService.StartName = ".\netsvc" Then errReturnCode = objService.StopService() End If Next
Switching Service Accounts to Local Service
Changes the service account to LocalService for any services running under the hypothetical service account Netsvc.
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colServices = objWMIService.ExecQuery _ ("Select * from Win32_Service") For each objService in colServices If objService.StartName = ".\netsvc" Then errServiceChange = objService.Change _ ( , , , , , , "NT AUTHORITY\LocalService" , "") End If Next