O'Reilly logo

Monad (AKA PowerShell) by Andy Oakley

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Auditing System Services

Many of the subsystems running on a Windows machine run as background processes, known as services, that have no direct interaction with a user's session. The components that exist as services are varied and include everything from the application-level Internet Information Services (IIS) and DNS Server to system plumbing of the Remote Procedure Call (RPC) and logon infrastructure. Services can be configured, started, and stopped from within the Services Administrative Tool , and command-line control of system services is available through the net start and net stop commands, as well as the sc.exe tool. MSH offers several cmdlets that complement the existing management tools and allow scripts to discover, interrogate, and manage the state of services within the shell in a consistent fashion.

How Do I Do That?

Let's start by getting a picture of the different services registered with the system. The get-service cmdlet, when called with no options, generates a list of all registered services, including their present state:

    MSH D:\MshScripts> get-service Status Name DisplayName ------ ---- ----------- Stopped Alerter Alerter Stopped ALG Application Layer Gateway Service Stopped AppMgmt Application Management Stopped aspnet_state ASP.NET State Service Running AudioSrv Windows Audio Stopped BITS Background Intelligent Transfer Ser... Stopped Browser Computer Browser Running CcmExec SMS Agent Host Stopped CiSvc Indexing Service Stopped ClipSrv ClipBook Stopped COMSysApp ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required