Disables all services configured as manual start. Among other things, this prevents Power Users from being able to start these services.

Size: px

Start display at page:

Download "Disables all services configured as manual start. Among other things, this prevents Power Users from being able to start these services."

Alan Carpenter
5 years ago
Views:

1 GO Software Pty Limited Map: 27 Tacoma Blvd, Pasadena SA 5042 Phn: Fax: none ABN: ACN: Eml: Web: VBScript Scripts to Manage Services Changing a Service Account Password Configuring Service Error Control Codes Configuring Service Start Options Determining Services that can be Paused Determining Services Running in All Processes Determining Services Running in a Process Determining Services that can be Stopped Enumerating Antecedent Services for a Single Service Enumerating Dependent Services for All Services Enumerating Dependent Services for a Single Service Enumerating Inactive Services Enumerating Service Load Order Groups Installing a Service Monitoring Service Performance Pausing Services Running Under a Specific Account Removing a Service Resuming AutoStart Services that are Paused Retrieving Service Properties Retrieving Service Status Retrieving Service Status Changes from Event Logs Starting AutoStart Services that have Stopped Starting a Service and Its Dependents Stopping a Service and Its Dependents Stopping Services Running Under a Specific Account Switching Service Accounts to Local Service Changing a Service Account Password Changes the service account password for any services running under the hypothetical service account Netsvc. WinObj="winmgmts:{impersonationLevel=impersonate}!\\" & strcomputer & "\root\cimv2" Set objwmiservice=getobject(winobj) For Each objservice in colservicelist If objservice.startname=".\netsvc" Then errreturn=objservice.change(,,,,,,, "password") Configuring Service Error Control Codes Configures all auto-start services to issue an alert if the service fails during startup. Const NORMAL ERROR CONTROL=2 SQL="Select * from Win32 Service where ErrorControl='Ignore'" errreturn=objservice.change(,,, NORMAL ERROR CONTROL) Configuring Service Start Options Disables all services configured as manual start. Among other things, this prevents Power Users from being able to start these services. SQL="Select * from Win32 Service where StartMode='Manual'" errreturncode=objservice.change(,,,, "Disabled") Determining Services that can be Paused Returns a list of services that can be stopped. SQL="Select * from Win32 Service Where AcceptPause=True" Determining Services Running in All Processes Returns a list of processes and all the services currently running in each process. set objiddictionary=createobject("scripting.dictionary") SQL="Select * from Win32 Service Where State <> 'Stopped'"

2 If objiddictionary.exists(objservice.processid) Then Else objiddictionary.add objservice.processid, objservice.processid colprocessids=objiddictionary.items For i=0 to objiddictionary.count - 1 SQL="Select * from Win32 Service Where ProcessID='" & colprocessids(i) & "'" Wscript.Echo "Process ID: " & colprocessids(i) Wscript.Echo VbTab & objservice.displayname Set objwmiservice= GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strcomputer & "\root\cimv2") SQL="Associators of {Win32 Service.Name='rasman'} Where AssocClass=Win32 DependentService Role=Antecedent" Determining Services Running in a Process Returns a list of services running in the Services.exe process. If objservice.pathname="c:\windows\system32\services.exe" Then Determining Services that can be Stopped Returns a list of services that can be stopped. SQL="Select * from Win32 Service Where AcceptStop=True" Enumerating Antecedent Services for a Single Service Enumerates all the services that must be running before the SMTP service can be started. SQL="Associators of {Win32 service.name='smtpsvc'} Where AssocClass=Win32 DependentService Role=Dependent" Enumerating Dependent Services for All Services Returns a list of all the services installed on a computer that are currently stopped. Const ForAppending=8 Set objfso=createobject("scripting.filesystemobject") Set objlogfile=objfso.opentextfile("c:\scripts\service dependencies.csv", ForAppending, True) objlogfile.write("service Dependencies") For Each objservice in collistofservices objserviceregistryname=objservice.name objservicedisplayname=objservice.displayname SQL="Associators of {Win32 Service.Name='" & objserviceregistryname & "'} " SQL=SQL & "Where AssocClass=Win32 DependentService Role=Antecedent" If colservicelist.count=0 then objlogfile.write(objservicedisplayname) & ", None" Else For Each objdependentservice in colservicelist objlogfile.write(objservicedisplayname) & ", " objlogfile.write(objdependentservice.displayname) objlogfile.writeline objlogfile.close Enumerating Dependent Services for a Single Service Enumerates all the services that cannot start until the Rasman service has started.

3 Enumerating Inactive Services Returns a list of all the services installed on a computer that are currently stopped. SQL="SELECT DisplayName, State FROM Win32 Service WHERE State <> 'Running'" Set objwmiservice= GetObject("winmgmts:" & "{impersonationlevel=impersonate}!\\" & strcomputer & "\root\cimv2") Set colstoppedservices=objwmiservice.execquery(sql) For Each objservice in colstoppedservices & "=" & objservice.state Enumerating Service Load Order Groups Returns a list of all the service load order groups found on a computer, and well as their load order. On Error Resume SQL="Select * from Win32 LoadOrderGroup" Set objwmiservice=getobject("winmgmts:\\" & strcomputer & "\root\cimv2") Set colitems=objwmiservice.execquery(sql) For Each objitem in colitems Wscript.Echo "Driver Enabled: " & objitem.driverenabled Wscript.Echo "Group Order: " & objitem.grouporder Wscript.Echo "Name: " & objitem.name Wscript.Echo Installing a Service Installs a hypothetical service Db.exe. Const OWN PROCESS=16 Const NOT INTERACTIVE=False Const NORMAL ERROR CONTROL=2 Set objservice=objwmiservice.get("win32 BaseService") SvcName="DbService" SvcDesc="Personnel Database" SvcPath="c:\windows\system32\db.exe" SvcStart="Manual" SvcLogon="NT AUTHORITY\LocalService" errreturn=objservice.create(svcname, SvcDesc, SvcPath, OWN PROCESS, NORMAL ERROR CONTROL, _ SvcStart, NOT INTERACTIVE, SvcLogon, "") Wscript.Echo errreturn Monitoring Service Performance Uses formatted performance counters to retrieve performance data for the DHCP Server service. set objrefresher=createobject("wbemscripting.swbemrefresher") Set coldhcpserver=objrefresher.addenum(objwmiservice, _ "win32 PerfFormattedData DHCPServer DHCPServer").ObjectSet objrefresher.refresh For i=1 to 60 For Each objdhcpserver in coldhcpserver Wscript.Echo "Acknowledgements per second: " & objdhcpserver.ackspersec Wscript.Echo "Declines per second: " & objdhcpserver.declinespersec Wscript.Echo "Discovers per second: " & objdhcpserver.discoverspersec Wscript.Echo "Informs per second: " & objdhcpserver.informspersec Wscript.Echo "Offers per second: " & objdhcpserver.offerspersec Wscript.Echo "Releases per second: " & objdhcpserver.releasespersec Wscript.Echo "Requests per second: " & objdhcpserver.requestspersec Wscript.Sleep objrefresher.refresh Pausing Services Running Under a Specific Account Pauses all services running under the hypothetical service account Netsvc. If objservice.startname=".\netsvc" Then errreturncode=objservice.pauseservice() Removing a Service Removes a hypothetical service named DbService. SQL="Select * from Win32 Service Where Name='DbService'"

4 objservice.stopservice() objservice.delete() Resuming AutoStart Services that are Paused Restarts any auto-start services that have been paused. SQL="Select * from Win32 Service Where State='Paused' and StartMode='Auto'" objservice.resumeservice() Retrieving Service Properties Retrieves a complete list of services and their associated properties. Information is saved to a text file: C:\Scripts\Service List.cs. Const ForAppending=8 Set objfso=createobject("scripting.filesystemobject") Set objlogfile=objfso.opentextfile("c:\scripts\service list.csv", ForAppending, True) Hdg="System Name, Service Name, Service Type, Service State, Exit Code, Process ID, Can Be Paused, " Hdg=Hdg & "Can Be Stopped, Caption, Description, Can Interact with Desktop, Display Name, " Hdg=Hdg & "Error Control, Executable Path Name, Service Started, Start Mode, Account Name" objlogfile.write(hdg) objlogfile.write(objservice.systemname) & ", " objlogfile.write(objservice.name) & ", " objlogfile.write(objservice.servicetype) & ", " objlogfile.write(objservice.state) & ", " objlogfile.write(objservice.exitcode) & ", " objlogfile.write(objservice.processid) & ", " objlogfile.write(objservice.acceptpause) & ", " objlogfile.write(objservice.acceptstop) & ", " objlogfile.write(objservice.caption) & ", " objlogfile.write(objservice.description) & ", " objlogfile.write(objservice.desktopinteract) & ", " objlogfile.write(objservice.displayname) & ", " objlogfile.write(objservice.errorcontrol) & ", " objlogfile.write(objservice.pathname) & ", " objlogfile.write(objservice.started) & ", " objlogfile.write(objservice.startmode) & ", " objlogfile.write(objservice.startname) & ", " objlogfile.writeline objlogfile.close Retrieving Service Status Returns a list of all the services installed on a computer, and indicates their current status (typically, running or not running). Set colrunningservices=objwmiservice.execquery(sql) For Each objservice in colrunningservices & VbTab & objservice.state Retrieving Service Status Changes from Event Logs Retrieves events from the System event log that have an event ID of These events are recorded any time a service changes status. Set dtmconverteddate=createobject("wbemscripting.swbemdatetime") SQL="Select * from Win32 NTLogEvent Where Logfile='System' and EventCode='7036'" Set colserviceevents=objwmiservice.execquery(sql) For Each strevent in colserviceevents dtmconverteddate.value=strevent.timewritten Wscript.Echo dtmconverteddate.getvardate Wscript.Echo strevent.message Starting AutoStart Services that have Stopped Restarts any auto-start services that have been stopped. SQL="Select * from Win32 Service Where State='Stopped' and StartMode='Auto'" objservice.startservice()

5 Starting a Service and Its Dependents Starts the NetDDE service and all its dependent services. SQL="Select * from Win32 Service where Name='NetDDE'" errreturn=objservice.startservice() Wscript.Sleep SQL="Associators of {Win32 Service.Name='NetDDE'} Where AssocClass=Win32 DependentService Role=Dependent" objservice.startservice() Stopping a Service and Its Dependents Stops the NetDDE service and all its dependent services. SQL="Associators of {Win32 Service.Name='NetDDE'} Where AssocClass=Win32 DependentService Role=Antecedent" objservice.stopservice() Wscript.Sleep SQL="Select * from Win32 Service where Name='NetDDE'" errreturn=objservice.stopservice() Stopping Services Running Under a Specific Account Stops all services running under the hypothetical service account Netsvc. SQL="Select * from win32 Service" If objservice.startname=".\netsvc" Then errreturncode=objservice.stopservice() Switching Service Accounts to Local Service Changes the service account to LocalService for any services running under the hypothetical service account Netsvc. If objservice.startname=".\netsvc" Then errservicechange=objservice.change(,,,,,, "NT AUTHORITY\LocalService", "") Copyright 2014 by GO Software Pty Limited

Overview. Program Start VB SCRIPT SIGNER. IT Services

Overview. Program Start VB SCRIPT SIGNER. IT Services Overview It is sometimes much easier (and easier to maintain) to use a Visual Basic Script on Windows to perform system functions rather than coding those functions in C++ (WMI is a good example of this).