Get-Service: Checking Windows Services Status with PowerShell

960

Services in Windows are one of the most important parts of the operating system. Previously, to get the status of a service on Windows, you had to use the services.msc graphical snap-in or the sc.exe command-line tool (for example, sc.exe query wuauserv).

In this article, we’ll look at how to use PowerShell to check the status of a Windows service on a local or remote computer. Also, we’ll discuss the type of services startup, and cover how to determine the dependencies of services.

Syntax of Get-Service cmdlet

You can get a list of installed services, their status, and startup type on a local or remote computer by using the Get-Service PowerShell cmdlet. When running Get-Service command without parameters, it returns a list of all services on the local computer.

To get the complete syntax of the Get-Service cmdlet, run the command:

get-help Get-Service

SYNTAX Get-Service [[-Name] <string[]>] [-ComputerName <string[]>] [-DependentServices] [-RequiredServices] [-Include <string[]>] [-Exclude <string[]>] [<CommonParameters>]

Using Get-Service to Check Windows Service Status

This command will list all local Windows services, their status (running, stopped, or paused), and display names:

Get-Service

The cmdlet returns a list of services sorted by name. The list contains the following Windows service properties:

• Status — shows if the service is Running or Stopped.
• Name — displays the short name of the service (used most often).
• Display Name — full name of the service (more descriptive and human-readable).

To export the services list to a text file for future investigation, use the Out-File cmdlet:

Get-Service | Out-File "C:\PS\Current_Services.txt"

To get two or more service states, you need to specify their names divided by commas:

get-service bits, wuauserv

If you need to display only running services, use this command:

Get-Service | Where-Object {$_.Status -EQ "Running"}

The pipeline operator (|) passes the results to the PowerShell Where-Object filter, which selects only those services for which the Status parameter is set to “Running”. If you want to display only the stopped services, specify “Stopped”.

You can get all the properties of the service object using the Get-Member.

get-service | get-member

As you can see, these objects have the type System.ServiceProcess.ServiceController. The screenshot shows all the available properties and methods of service objects in Windows (most of them are not listed in the default view).

You can display the properties of the specific service. For example, we need to display the Display Name, Status, and features of the Windows Update (wuauserv) service. Use the PowerShell Select-Object cmdlet to list only the service properties that you want:

Get-Service wuauserv | Select-Object Displayname,Status,ServiceName,Can*

DisplayName : Windows Update

Status : Stopped

CanPauseAndContinue : False

CanShutdown : False

CanStop : False

You can find all services that can be paused and resumed without a Windows restart:

Get-Service | Where-Object {$_.canpauseandcontinue -eq "True"}

You can check the startup type of Windows services with the command:

Get-Service | select -property name,starttype

If you need to get the startup type of the service only, run:

(Get-Service -Name wuauserv).StartType

There are 4 possible startup types for Windows services:

• Automatic — automatic start during Windows boot.
• AutomaticDelayedStart — startup after operating system boot.
• Manual — manual start.
• Disabled — the service is disabled.

Note. You can check how to install and configure SNMP service on Windows.

You can filter the services list by the service name using the asterisk as a wildcard:

get-service wi*

Also, note that PowerShell is not a case-sensitive language. It means that the following commands will return equal results:

get-service win*

get-service WIN*

To exclude some services from the resulting list you can use the -Exclude option:

Get-Service -Name "win*" -Exclude "WinRM"

You can sort services in descending order by the value of the Status property (running services are displayed earlier than stopped):

get-service s* | sort-object status –Descending

Tip. Unfortunately, the Get-Service cmdlet doesn’t allow you to get information about the user account under which the service is running. If you need to find all the services running under non-default system accounts, use the Get-CIMInstance cmdlet:

Get-CIMInstance -Class Win32_Service -filter "StartName != 'LocalSystem' AND NOT StartName LIKE 'NT Authority%' " |Select-Object SystemName, Name, Caption, StartMode, StartName, State | Sort-Object StartName

A fairly common task for an administrator when troubleshooting Windows problems is to check which of the Windows services that should be running automatically are currently stopped. You can use the FilterScript option to search for services that have the Automatic startup type and not currently running:

Get-Service | where -FilterScript {$_.Status -ne 'Running' -and $_.StartType -eq 'Automatic'} | ft 'Name','StartType','Status'

Also note that PowerShell Core 7.x introduces additional properties of the Get-Service that are not available in Windows PowerShell 5.1 (for example UserName, BinaryPathName, StartType). You can get the value of these properties in the pwsh.exe console (PowerShell 7.x).

Get-Service wuauserv | select Username,Starttype,BinaryPathName

How to Check Status if a Specific Service Exists via PowerShell?

If you want to check whether a specific Windows service currently exists, you can use the following PowerShell script:

$servicename = “SomeService”

if (Get-Service $servicename -ErrorAction SilentlyContinue)

{

Write-Host "$servicename exists"

# do something

}

Else {

Write-Host ” $servicename not found”

# do something

}

You can check if a specific Windows service exists on a list of remote computers/servers. To perform this task, you need to save the list of remote computers to the text file comp_list.txt in a simple format:

server1

server2

server3

PC21

PC34

Now run the following PowerShell script:

$servicename = "SomeService"

$list = get-content “c:\ps\comp_list.txt”

foreach ($server in $list) {

if (Get-Service $servicename -computername $server -ErrorAction 'SilentlyContinue'){

Write-Host "$servicename exists on $server "

# do something

}

else{write-host "No service $servicename found on $server."}

}

Get-Service Status from Remote Computer using PowerShell

You can use the Get-Service cmdlet to get the status of services not only on the local but also on remote computers. To do this, use the –ComputerName parameter. You can use the NetBIOS, FQDN name, or an IP address as a computer name. Connection to remote computers is established not through PowerShell Remoting (WinRM), but through Service Manager (similar to the sc.exe command).

get-service wuauserv -ComputerName remotePC1

You can check the status of the services on multiple remote computers at once (their names must be separated with commas).

get-service spooler -ComputerName remotePC1,remotePC2, remotePC3| format-table Name,Status,Machinename –autosize

You can also check the health of the service on a list of remote computers from a plain text file:

$list = get-content “c:\ps\comp_list.txt”

Get-Service -Computername $list -Name spooler | Select-Object MachineName,Name,Displayname,Status | Sort-Object Status

Or you can check the service state on all computers in a specific Active Directory OU:

$Computers = (Get-ADComputer -SearchBase ‘OU=Servers,OU=UK,DC=theitbros,DC=com’).names

foreach ($computer in $computers)

{

Get-Service -ComputerName $computer.Name -Name wuauserv | Where-Object {$_.status -eq "running"} | select status,name,machinename

}

To restart a service on a remote computer, use the following command:

Get-Service wuauserv -ComputerName server1| Restart-Service

Note. The Get-Service cmdlet in PowerShell Core (PowerShell 6.x and 7.x), unlike Windows PowerShell 5.1, does not have the ComputerName parameter, so you cannot use it to check the status of services on remote computers.

To access remote computers from within PowerShell Core, you must use PowerShell Remoting over WinRM. For example, you can poll service status on multiple remote computers using the Invoke-Command. For example:

$cred = Get-Credential

Invoke-Command -ComputerName dc03,dc02 {get-service wuauserv} -Credential $cred

Use Get-Service to Display Service Dependencies

The Get-Service cmdlet has two other useful parameters you can use when managing Windows services. The DependentServices parameter returns services that depend on this service. The RequiredServices parameter returns the services on which this service depends.

The following command receives the services that needed to be run before starting the LanmanWorkstation service:

Get-Service -Name LanmanWorkstation –RequiredServices

The next command returns dependent services that require the LanmanWorkstation service:

Get-Service -Name LanmanWorkstation -DependentServices

List all of the services that have dependencies:

Get-Service | Where-Object {$_.RequiredServices -or $_.DependentServices} |FT -Property Status, Name, RequiredServices, DependentServices -auto

If you manually stop all dependence services, you won’t be able to run your service. In order to automatically run all dependency services, use the following PowerShell one-liner:

get-service servicename | Foreach {start-service $_.name -passthru; start-service $_.DependentServices -passthru}

Managing Windows Services via PowerShell

There are other useful cmdlets in the PowerShell module for managing services. To list all available PowerShell commands used to manage Windows services, run:

Get-Command -Noun Service

Here is a complete list of the service management cmdlets in PowerShell Core 7.3:

• Get-Service
• New-Service
• Remove-Service
• Restart-Service
• Resume-Service
• Set-Service
• Start-Service
• Stop-Service
• Suspend-Service

You can use these cmdlets to start, stop, restart, or change the startup type of the service.

To manage services, be sure to run powershell.exe as an administrator. You must start, stop, restart, or change the startup type of the service.

Stop service:

Stop-Service -Name Windefend

When you stop some services, an error may appear:

Stop-Service: Cannot stop service ‘SQL Server (MSSQLSERVER) (MSSQLSERVER)’ because it has dependent services. It can only be stopped if the Force flag is set.

To force stop this and the dependent service, use the -Force parameter:

Stop-Service –Name MSSQLSERVER -Force

Start the service:

Start-Service -Name Windefend

Restart the service:

Restart-Service -Name Windefend

Hint. You can force restart a hanging Windows service with the commands:

$ServiceProcess = Get-CimInstance -ClassName Win32_Service -filter "name = 'myservicename'"

Stop-Process -Id $ServiceProcess.ProcessId

If you need to change the startup type of the service (for example, from Automatic to Disabled), run:

Set-Service 'WinRM' -StartupType Disabled

Or you can change the service description:

Set-Service 'myservice' -Description 'some test'

You can set the service to run under a specific user account. Previously, these settings could be set only manually on the Log on tab in the Services console GUI.

First you need to get the username and password:

$Credential = Get-Credential

Once the credentials have been captured, you can set them for the service. The service must be stopped before changing the credentials:

$ServiceName = 'mysvc'

Get-Service -Name $ServiceName | Stop-Service

Set-Service -Name $ServiceName -Credential $Credential

Get-Service -Name $ServiceName | Start-Service

Some Windows services can be suspended using the Suspend-Service command:

Get-Service -Name 'wuauserv'|Suspend-Service

If you try to suspend a service that does not support this method, an error will appear:

Suspend-Service : Service ‘Windows Update (wuauserv)’ cannot be suspended because the service does not support being suspended or resumed.

To find the Windows services you can pause, run the command:

Get-Service | where CanPauseAndContinue | select -Property Name,CanPauseAndContinue,DisplayName

The Resume-Service cmdlet is used to start the suspended service:

Get-Service -Name 'Winmgmt' | Suspend-Service | Resume-Service

To create a new service with the New-Service cmdlet, you must specify its name and the path to the binary file:

New-Service -Name 'MyNewService' -BinaryPathName 'C:\ps\testsvc.exe'

You can use the New-Service cmdlet to specify an account credential to start a service with:

$credential = Get-Credential

New-Service -Name 'MyNewService'-BinaryPathName 'C:\ps\testsvc.exe' -DisplayName 'My Test Service' -Credential $credential -DependsOn WinRM

Hint. Enter your domain user account name as user@domain.com.

To delete a service:

Remove-Service -Name 'MyNewService'

Note. The Remove-Service cmdlet is available in PowerShell Core 6.x +.