GO Software Pty Limited Map: 27 Tacoma Blvd, Pasadena SA 5042 Phn: 0403-063-991 Fax: none ABN: 54-008-044-906 ACN: 008-044-906 Eml: support@gosoftware.com.au Web: www.gosoftware.com.au VBScript Scripts to Manage Services Changing a Service Account Password Configuring Service Error Control Codes Configuring Service Start Options Determining Services that can be Paused Determining Services Running in All Processes Determining Services Running in a Process Determining Services that can be Stopped Enumerating Antecedent Services for a Single Service Enumerating Dependent Services for All Services Enumerating Dependent Services for a Single Service Enumerating Inactive Services Enumerating Service Load Order Groups Installing a Service Monitoring Service Performance Pausing Services Running Under a Specific Account Removing a Service Resuming AutoStart Services that are Paused Retrieving Service Properties Retrieving Service Status Retrieving Service Status Changes from Event Logs Starting AutoStart Services that have Stopped Starting a Service and Its Dependents Stopping a Service and Its Dependents Stopping Services Running Under a Specific Account Switching Service Accounts to Local Service Changing a Service Account Password Changes the service account password for any services running under the hypothetical service account Netsvc. WinObj="winmgmts:{impersonationLevel=impersonate}!\\" & strcomputer & "\root\cimv2" Set objwmiservice=getobject(winobj) For Each objservice in colservicelist If objservice.startname=".\netsvc" Then errreturn=objservice.change(,,,,,,, "password") Configuring Service Error Control Codes Configures all auto-start services to issue an alert if the service fails during startup. Const NORMAL ERROR CONTROL=2 SQL="Select * from Win32 Service where ErrorControl='Ignore'" errreturn=objservice.change(,,, NORMAL ERROR CONTROL) Configuring Service Start Options Disables all services configured as manual start. Among other things, this prevents Power Users from being able to start these services. SQL="Select * from Win32 Service where StartMode='Manual'" errreturncode=objservice.change(,,,, "Disabled") Determining Services that can be Paused Returns a list of services that can be stopped. SQL="Select * from Win32 Service Where AcceptPause=True" Determining Services Running in All Processes Returns a list of processes and all the services currently running in each process. set objiddictionary=createobject("scripting.dictionary") SQL="Select * from Win32 Service Where State <> 'Stopped'"
If objiddictionary.exists(objservice.processid) Then Else objiddictionary.add objservice.processid, objservice.processid colprocessids=objiddictionary.items For i=0 to objiddictionary.count - 1 SQL="Select * from Win32 Service Where ProcessID='" & colprocessids(i) & "'" Wscript.Echo "Process ID: " & colprocessids(i) Wscript.Echo VbTab & objservice.displayname Set objwmiservice= GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strcomputer & "\root\cimv2") SQL="Associators of {Win32 Service.Name='rasman'} Where AssocClass=Win32 DependentService Role=Antecedent" Determining Services Running in a Process Returns a list of services running in the Services.exe process. If objservice.pathname="c:\windows\system32\services.exe" Then Determining Services that can be Stopped Returns a list of services that can be stopped. SQL="Select * from Win32 Service Where AcceptStop=True" Enumerating Antecedent Services for a Single Service Enumerates all the services that must be running before the SMTP service can be started. SQL="Associators of {Win32 service.name='smtpsvc'} Where AssocClass=Win32 DependentService Role=Dependent" Enumerating Dependent Services for All Services Returns a list of all the services installed on a computer that are currently stopped. Const ForAppending=8 Set objfso=createobject("scripting.filesystemobject") Set objlogfile=objfso.opentextfile("c:\scripts\service dependencies.csv", ForAppending, True) objlogfile.write("service Dependencies") For Each objservice in collistofservices objserviceregistryname=objservice.name objservicedisplayname=objservice.displayname SQL="Associators of {Win32 Service.Name='" & objserviceregistryname & "'} " SQL=SQL & "Where AssocClass=Win32 DependentService Role=Antecedent" If colservicelist.count=0 then objlogfile.write(objservicedisplayname) & ", None" Else For Each objdependentservice in colservicelist objlogfile.write(objservicedisplayname) & ", " objlogfile.write(objdependentservice.displayname) objlogfile.writeline objlogfile.close Enumerating Dependent Services for a Single Service Enumerates all the services that cannot start until the Rasman service has started.
Enumerating Inactive Services Returns a list of all the services installed on a computer that are currently stopped. SQL="SELECT DisplayName, State FROM Win32 Service WHERE State <> 'Running'" Set objwmiservice= GetObject("winmgmts:" & "{impersonationlevel=impersonate}!\\" & strcomputer & "\root\cimv2") Set colstoppedservices=objwmiservice.execquery(sql) For Each objservice in colstoppedservices & "=" & objservice.state Enumerating Service Load Order Groups Returns a list of all the service load order groups found on a computer, and well as their load order. On Error Resume SQL="Select * from Win32 LoadOrderGroup" Set objwmiservice=getobject("winmgmts:\\" & strcomputer & "\root\cimv2") Set colitems=objwmiservice.execquery(sql) For Each objitem in colitems Wscript.Echo "Driver Enabled: " & objitem.driverenabled Wscript.Echo "Group Order: " & objitem.grouporder Wscript.Echo "Name: " & objitem.name Wscript.Echo Installing a Service Installs a hypothetical service Db.exe. Const OWN PROCESS=16 Const NOT INTERACTIVE=False Const NORMAL ERROR CONTROL=2 Set objservice=objwmiservice.get("win32 BaseService") SvcName="DbService" SvcDesc="Personnel Database" SvcPath="c:\windows\system32\db.exe" SvcStart="Manual" SvcLogon="NT AUTHORITY\LocalService" errreturn=objservice.create(svcname, SvcDesc, SvcPath, OWN PROCESS, NORMAL ERROR CONTROL, _ SvcStart, NOT INTERACTIVE, SvcLogon, "") Wscript.Echo errreturn Monitoring Service Performance Uses formatted performance counters to retrieve performance data for the DHCP Server service. set objrefresher=createobject("wbemscripting.swbemrefresher") Set coldhcpserver=objrefresher.addenum(objwmiservice, _ "win32 PerfFormattedData DHCPServer DHCPServer").ObjectSet objrefresher.refresh For i=1 to 60 For Each objdhcpserver in coldhcpserver Wscript.Echo "Acknowledgements per second: " & objdhcpserver.ackspersec Wscript.Echo "Declines per second: " & objdhcpserver.declinespersec Wscript.Echo "Discovers per second: " & objdhcpserver.discoverspersec Wscript.Echo "Informs per second: " & objdhcpserver.informspersec Wscript.Echo "Offers per second: " & objdhcpserver.offerspersec Wscript.Echo "Releases per second: " & objdhcpserver.releasespersec Wscript.Echo "Requests per second: " & objdhcpserver.requestspersec Wscript.Sleep 10000 objrefresher.refresh Pausing Services Running Under a Specific Account Pauses all services running under the hypothetical service account Netsvc. If objservice.startname=".\netsvc" Then errreturncode=objservice.pauseservice() Removing a Service Removes a hypothetical service named DbService. SQL="Select * from Win32 Service Where Name='DbService'"
objservice.stopservice() objservice.delete() Resuming AutoStart Services that are Paused Restarts any auto-start services that have been paused. SQL="Select * from Win32 Service Where State='Paused' and StartMode='Auto'" objservice.resumeservice() Retrieving Service Properties Retrieves a complete list of services and their associated properties. Information is saved to a text file: C:\Scripts\Service List.cs. Const ForAppending=8 Set objfso=createobject("scripting.filesystemobject") Set objlogfile=objfso.opentextfile("c:\scripts\service list.csv", ForAppending, True) Hdg="System Name, Service Name, Service Type, Service State, Exit Code, Process ID, Can Be Paused, " Hdg=Hdg & "Can Be Stopped, Caption, Description, Can Interact with Desktop, Display Name, " Hdg=Hdg & "Error Control, Executable Path Name, Service Started, Start Mode, Account Name" objlogfile.write(hdg) objlogfile.write(objservice.systemname) & ", " objlogfile.write(objservice.name) & ", " objlogfile.write(objservice.servicetype) & ", " objlogfile.write(objservice.state) & ", " objlogfile.write(objservice.exitcode) & ", " objlogfile.write(objservice.processid) & ", " objlogfile.write(objservice.acceptpause) & ", " objlogfile.write(objservice.acceptstop) & ", " objlogfile.write(objservice.caption) & ", " objlogfile.write(objservice.description) & ", " objlogfile.write(objservice.desktopinteract) & ", " objlogfile.write(objservice.displayname) & ", " objlogfile.write(objservice.errorcontrol) & ", " objlogfile.write(objservice.pathname) & ", " objlogfile.write(objservice.started) & ", " objlogfile.write(objservice.startmode) & ", " objlogfile.write(objservice.startname) & ", " objlogfile.writeline objlogfile.close Retrieving Service Status Returns a list of all the services installed on a computer, and indicates their current status (typically, running or not running). Set colrunningservices=objwmiservice.execquery(sql) For Each objservice in colrunningservices & VbTab & objservice.state Retrieving Service Status Changes from Event Logs Retrieves events from the System event log that have an event ID of 7036. These events are recorded any time a service changes status. Set dtmconverteddate=createobject("wbemscripting.swbemdatetime") SQL="Select * from Win32 NTLogEvent Where Logfile='System' and EventCode='7036'" Set colserviceevents=objwmiservice.execquery(sql) For Each strevent in colserviceevents dtmconverteddate.value=strevent.timewritten Wscript.Echo dtmconverteddate.getvardate Wscript.Echo strevent.message Starting AutoStart Services that have Stopped Restarts any auto-start services that have been stopped. SQL="Select * from Win32 Service Where State='Stopped' and StartMode='Auto'" objservice.startservice()
Starting a Service and Its Dependents Starts the NetDDE service and all its dependent services. SQL="Select * from Win32 Service where Name='NetDDE'" errreturn=objservice.startservice() Wscript.Sleep 20000 SQL="Associators of {Win32 Service.Name='NetDDE'} Where AssocClass=Win32 DependentService Role=Dependent" objservice.startservice() Stopping a Service and Its Dependents Stops the NetDDE service and all its dependent services. SQL="Associators of {Win32 Service.Name='NetDDE'} Where AssocClass=Win32 DependentService Role=Antecedent" objservice.stopservice() Wscript.Sleep 20000 SQL="Select * from Win32 Service where Name='NetDDE'" errreturn=objservice.stopservice() Stopping Services Running Under a Specific Account Stops all services running under the hypothetical service account Netsvc. SQL="Select * from win32 Service" If objservice.startname=".\netsvc" Then errreturncode=objservice.stopservice() Switching Service Accounts to Local Service Changes the service account to LocalService for any services running under the hypothetical service account Netsvc. If objservice.startname=".\netsvc" Then errservicechange=objservice.change(,,,,,, "NT AUTHORITY\LocalService", "") Copyright 2014 by GO Software Pty Limited