Get-Service: Checking Windows Services Status with PowerShell

The built-in Get-Service PowerShell cmdlet can be used to get a list of Windows services, check their statuses, filter them by name or service status. Let’s learn how to use Get-Service to check Windows services.

Syntax and Basic Usage of the Get-Service Cmdlet

The Get-Service cmdlet retrieves information about Windows services on the local machine.

In PowerShell 7.x, the basic syntax is:

Get-Service [-Name] <String[]>

or:

Get-Service [-DisplayName] <String[]>

The cmdlet can also be used with additional parameters such as -DependentServices and -RequiredServices

Legacy remote service management

In Windows PowerShell 5.1, Get-Service included the -ComputerName parameter:

Get-Service -ComputerName SERVER01

Keep in mind that this parameter relies on DCOM and is not available in PowerShell 7.x.

For modern environments, you should use PowerShell Remoting (WinRM):

Invoke-Command -ComputerName SERVER01 {
Get-Service
}

When run without parameters, the Get-Service command displays a list of all the services on the local computer and their statuses.

Check the specific service is running

To check whether the specific service is running or not, specify its name or DisplayName:

Get-Service wuauserv

Or

Get-Service -DisplayName "Windows Update"

Get the status of multiple services at once:

Get-Service WSLService, WwanSvc, WlanSvc

If you don’t know the exact name of the service, you can use wildcards. For example, to list all services whose display name starts with Microsoft:

Get-Service -DisplayName Microsoft*

Use the Where-Object cmdlet to list only services with a specific state. For example, list all stopped services:

Get-Service | Where-Object Status -eq 'Stopped'

Get-Service: Advanced Usage Examples

The Get-Service cmdlet returns a default property set consisting of the following properties:

• Status — Indicates the current service status. The possible values are: Stopped, StartPending, StopPending, Running, ContinuePending, PausePending, Paused.
• Name — Displays the short name of the service
• Display Name — Show the friendly name of the service.

However, other service object properties are not displayed. You can see them all by running the command below:

Get-Service | Get-Member | Where-Object { $_.MemberType -like "*property" } | Select-Object Name, MemberType

View All Get-Service Properties

The Get-Service cmdlet returns a ServiceController object. By default, only the most common properties such as Status, Name, and DisplayName are displayed.

In order to view all properties exposed by the object, you should use Format-List * parameter:

Get-Service -Name Spooler | Format-List *

The command above displays all available properties returned by Get-Service, which can be useful when troubleshooting services.

For example, you can sort services by status and display the most important fields:

Get-Service |
Sort-Object Status, DisplayName |
Format-Table Status, Name, DisplayName

For full service config details, including startup mode, service account, and executable path, you should use Get-CimInstance with the Win32_Service class.

Using Get-CimInstance for Detailed Service Information

While Get-Service is pretty useful for checking basic service status, it provides a lack of information about service config. Modern PowerShell users use Get-CimInstance with the Win32_Service class to see the full details of a service. This includes:

• startup type (StartMode)
• service binary path (PathName)
• service account (StartName)
• detailed state information

This approach uses CIM (Common Information Model) and works consistently across Windows PowerShell and PowerShell 7+.

Here is an example of the command:

Get-CimInstance Win32_Service | Select-Object Name, State, StartMode, StartName, PathName

Using Where-Object, you can also filter services based on their startup type/current state:

Get-CimInstance Win32_Service | Where-Object StartMode -eq 'Auto' | Select-Object Name, State, StartMode

Get-CimInstance Win32_Service |
Where-Object { $_.StartMode -eq 'Auto' -and $_.State -ne 'Running' } |
Select-Object Name, State, StartMode

The example above helps you to identify services that are configured to start automatically but are not currently running (this is a common task when troubleshooting and auditing).

You should keep in mind that Get-Service may not always expose complete or consistent startup type information. In case you need more reliable results, we recommend you to use Get-CimInstance (Win32_Service).

StartType property

Note that the availability of the StartType property depends on the PowerShell version. In PowerShell 7+, Get-Service exposes the StartType property. In Windows PowerShell 5.1, you should use Get-CimInstance with the Win32_Service class to retrieve the configured startup type.

Among these other properties, the most preferred when checking the service status is the StartType, which indicates whether the service start type is:

• Automatic — Service starts automatically during the system start-up.
• Manual — Service must be started manually by a user or application.
• AutomaticDelayedStart — service starts automatically on boot after core network services are run.
• Disabled — Service is disabled.

These values are sufficient for quick inspection tasks, but for enterprise-level auditing/automation scenarios, we recommend you to use CIM-based queries.

The following examples demonstrate how startup type information can be queried using CIM-based service data.

List services whose StartType is Automatic:

Get-CimInstance Win32_Service | Where-Object StartMode -eq 'Auto' | Select-Object Name, State, StartMode

List services that should start automatically but are not currently running:

Get-CimInstance Win32_Service |
Where-Object {
$_.StartMode -eq 'Auto' -and
$_.State -ne 'Running'
} |
Select-Object State, Name, DisplayName, StartMode

Get service dependency. Such services may fail to start if their dependent services are not running:

Get-Service Dfs -RequiredServices

According to the result below, the Dfs service has six dependencies, and one is not running (Stopped), which is the RemoteRegistry.

Troubleshooting Service Dependencies

Note that Windows services often depend on other services. In case a required dependency is stopped/fails to start, the main service may also fail. The -RequiredServices parameter shows services that the specified service depends on.

For example, to check the dependencies of the Print Spooler service, use the following command:

Get-Service -Name Spooler -RequiredServices

Here is an example output:

Status   Name       DisplayName
------   ----       -----------
Running  RpcSs      Remote Procedure Call (RPC)
Running  DcomLaunch DCOM Server Process Launcher

Keep in mind that in case one of the required services is stopped, the main service may not start correctly.

You can check the status of all required services with the command:

Get-Service -Name Spooler -RequiredServices |
Select-Object Name, Status, DisplayName

In order to find services that depend on a specific service, use the -DependentServices parameter:

Get-Service -Name RpcSs -DependentServices

This is useful before stopping a production service because stopping a required service may impact other apps.

For example, before stopping a service, you should check which services depend on it:

Get-Service -Name RpcSs -DependentServices |
Select-Object Name, Status, DisplayName

You can also use a simple check to find stopped dependencies:

$service = Get-Service -Name Spooler

$service.RequiredServices |
Where-Object Status -ne 'Running' |
Select-Object Name, Status, DisplayName

This helps you to identify why a service cannot start and which dependency requires attention first.

Check Services on a Remote Computer with PowerShell

The Get-Service cmdlet retrieves the service status in the local computer by default. But it is capable of getting the service status on a remote computer.

On Windows PowerShell, the Get-Service cmdlet has a parameter called -ComputerName that accepts an array of computer names to query. This method (uses the DCOM to connect to the remote machine and execute the command against it) is considered legacy and is only available in Windows PowerShell. Modern PowerShell versions rely on PowerShell Remoting (WinRM) or CIM-based approaches.

For example, this command retrieves the status of the services on the remote computers named DC1 and PCX.

Get-Service -Name WinRM -ComputerName DC1,PCX | Select-Object Status,Name,MachineName

On PowerShell Core (6.x+), the -ComputerName parameter has been removed from the Get-Service cmdlet because of PowerShell Core’s move away from DCOM. Instead, you must use the Invoke-Command cmdlet, which uses the WinRM to communicate to remote machines.

Invoke-Command -ComputerName DC1, PCX {Get-Service WinDefend, wuauserv | Select-Object Status, Name, DisplayName}

You can also use CIM sessions with Get-CimInstance to grab info from multiple remote servers at the same time:

Get-CimInstance Win32_Service -ComputerName DC1, PCX | Select-Object Name, State, StartMode

Permissions required for remote CIM queries

In order to query services on remote computers using Get-CimInstance, the account running the command must have appropriate permissions on the target machine. By default, remote CIM/WMI queries usually require local admin privileges on the remote computer. Keep in mind that you can delegate access by configuring WMI namespace permissions instead of granting full local admin rights.

The required permissions depend on the transport method:

• WSMan (default in PowerShell 7+) requires WinRM access.
• DCOM-based CIM connections require WMI/DCOM permissions.

How to Query Services on Multiple Machines from CSV File

When working with enterprise environment, usually you need to manage multiple servers instead of checking one machine at a time. You can store server names in a CSV file and query service status remotely. Here is an example of a CSV file:

ComputerName
DC01
SQL01
WEB01
FILE01

The following script allows you to collect service status info from multiple servers in a single operation:

$Servers = Import-Csv C:\Temp\Servers.csv

Invoke-Command -ComputerName $Servers.ComputerName {
Get-Service -Name WinRM |
Select-Object Status, Name, DisplayName
} |
Select-Object PSComputerName, Status, Name, DisplayName

Managing Windows Services with PowerShell

The Get-Service cmdlet is primarily used for monitoring services. To manage Windows services, PowerShell provides you with a several additional cmdlets:

• Start-Service — starts a stopped service
• Stop-Service — stops a running service
• Restart-Service — restarts a service
• Set-Service — changes service config such as startup type

In order to start a Windows service, use the command:

Start-Service -Name Spooler

To check it, use the command:

Get-Service -Name Spooler

In case you need to stop a Windows service, use the command:

Stop-Service -Name Spooler

Note that stopping a service may affect dependent apps. You should always check service dependencies before stopping a production service.

To restart a Windows service, use the following command:

Restart-Service -Name Spooler

You can also add -Force parameter (but you should use it carefully because it can also stop dependent services):

Restart-Service -Name Spooler -Force

To change service startup type, use the command:

Set-Service -Name Spooler -StartupType Automatic

Automating Windows Service Monitoring and Auditing

It’s obviously that admins rarely check services manually. If that’s true in your case, you can use PowerShell in order to create service inventory reports, detect stopped services, and integrate service checks into monitoring workflows.

Here are the common use cases:

• auditing service configs across servers;
• detecting stopped critical services;
• generating reports for compliance reviews;
• integrating checks with monitoring platforms.

Export Windows Services Inventory to CSV

Our example below exports all services with their current state, startup mode, service account, and executable path:

Get-CimInstance Win32_Service |
Select-Object State, Name, DisplayName, StartMode, StartName, PathName |
Export-Csv -Path C:\Reports\ServicesInventory.csv -NoTypeInformation

You can use this report for documentation, troubleshooting, and config audits.

Find Automatic Services That Are Not Running

A common admin task is identifying services configured with an automatic startup mode but currently not running. Use the following command:

Get-CimInstance Win32_Service |
Where-Object {
$_.StartMode -eq 'Auto' -and
$_.State -ne 'Running'
} |
Select-Object State, Name, DisplayName, StartMode

This helps you to quickly identify potential service availability issues.

Monitor Critical Services

Instead of checking every service, enterprise environments usually monitor only critical services required for a specific server role.

Here is an example:

$CriticalServices = @(
"NTDS",
"DNS",
"KDC",
"Netlogon"
)

Get-Service -Name $CriticalServices |
Where-Object Status -ne 'Running' |
Select-Object Name, Status, DisplayName

This method reduces false alerts and focuses monitoring on services required for business operations.

Send an Alert When a Service Stops

Our next example checks a service and can be integrated with monitoring systems:

$ServiceName = "Spooler"

$Service = Get-Service -Name $ServiceName

if ($Service.Status -ne "Running") {

Write-Warning "Service $ServiceName is not running"
}

Keep in mind that notifications are usually integrated with enterprise monitoring platforms such as Microsoft Sentinel, Azure Monitor, or third-party monitoring solutions.

You can also check DCs health. Note that DCs depend on several critical services:

$DCServices = @(
"NTDS",
"DNS",
"KDC",
"Netlogon",
"W32Time"
)

Get-Service -Name $DCServices |
Select-Object Name, Status

Wrapping Up

The Get-Service PowerShell cmdlet is an easy and powerful way to check the status of Windows services on local or remote computers. It is commonly used for inspecting service status, while service management is usually performed using other cmdlets such as Start-Service or Set-Service.

Get-Service wuauserv

Get-Service -DisplayName "Windows Update"

Get-CimInstance Win32_Service