Services

0. Show all running services:

• net start
• sc query
• gwmi win32_service | where {$_.state -eq 'running'}j
• Get-WmiObject Win32_Service -filter "State like 'Running'" | select name will just show name
• Get-CimInstance -ClassName Win32_Service | where state -match 'running
• 'wmic service get name,pathname /format:list
• 'wmic service where state='running' get name,pathname,status,state /format:list
• psserivce

0. Show all running services on a remote host: sc \xp.ops.local gwmi win32_service -computername win7 -credential fred | where {$_.state -eq ‘running’} psservice \computer -u user -p password ‘wmic /node:XP service get name,pathname /format:list psservice \xp.ops.local -u xp\administrator -p L33tHax0r query -s all

   Query the status of Windows “Security Center” serivce (on XP): psservice \xp.ops.local -u administrator -p L33thax0r query “Security Center” or you can use service name wscsvc psservice \xp.ops.local -u xp\administrator -p L33tHax0r query wscsvc psservice querry “Display Name or Service Name”

Start/Stop/pause a service: net start <“service display name”> i.e. “print spooler” not spoolsv.exe or spooler sc start spooler psservice stop w32time or psservice stop “Windows Time” psservice start w32time

Find a service name associated with the services display name: sc getkeyname “Display_Name” i.e sc getkeyname “Print Spooler”

Change a service: sc config option i.e. sc config netlogon start= “disabled” (space after = is required) sc config by itself will give you the options/format you can change psservice config “Windows Event Collector” or psservice config wecsvc psservice config wecsvc /? Shows you options

Look at services that are set to start automatically: wmic SERVICE WHERE StartMode=“Auto” GET Name, State Get service dependcies: psservice depend Get configuration of a service: psservice config wecsvc Config the Windows “Parental Controls” service to start automatically: psservice setconfig “parental Controls” auto