{"id":684,"date":"2008-09-30T02:00:51","date_gmt":"2008-09-30T10:00:51","guid":{"rendered":"http:\/\/www.sapien.com\/blog\/2008\/09\/30\/more-fun-with-services-powershell-and-adsi\/"},"modified":"2008-09-25T07:53:19","modified_gmt":"2008-09-25T15:53:19","slug":"more-fun-with-services-powershell-and-adsi","status":"publish","type":"post","link":"https:\/\/dev.sapien.com\/blog\/2008\/09\/30\/more-fun-with-services-powershell-and-adsi\/","title":{"rendered":"More fun with services, PowerShell and ADSI"},"content":{"rendered":"

The other day I showed you how to use ADSI and PowerShell to manage services on remote computers. Since the ADSI type adapter is admittedly “kludgy” at times, I put together a script that you could use like a cmdlet to retrieve service information via ADSI.<\/p>\n

\n
\n
   1:<\/span> #Get-RemoteService.ps1<\/span><\/pre>\n
   2:<\/span>  <\/pre>\n
   3:<\/span> param<\/span>([string]$computername=$env:computername,<\/pre>\n
   4:<\/span>       [string]$service=$(Throw \"You must enter a service name like spooler\"<\/span>)<\/pre>\n
   5:<\/span>       )<\/pre>\n
   6:<\/span>  <\/pre>\n
   7:<\/span> function<\/span> Decode-StartType {<\/pre>\n
   8:<\/span>     Param([int]$startType)<\/pre>\n
   9:<\/span>  <\/pre>\n
  10:<\/span>     Switch ($startType) {<\/pre>\n
  11:<\/span>         0    {\"Boot\"<\/span>}<\/pre>\n
  12:<\/span>         1    {\"System\"<\/span>}<\/pre>\n
  13:<\/span>         2    {\"Automatic\"<\/span>}<\/pre>\n
  14:<\/span>         3    {\"Manual\"<\/span>}<\/pre>\n
  15:<\/span>         4    {\"Disabled\"<\/span>}<\/pre>\n
  16:<\/span>        default<\/span>    {\"Unknown\"<\/span>}<\/pre>\n
  17:<\/span>     }<\/pre>\n
  18:<\/span> }<\/pre>\n
  19:<\/span>  <\/pre>\n
  20:<\/span> Function Decode-ServiceType {<\/pre>\n
  21:<\/span>     Param([int]$ServiceType)<\/pre>\n
  22:<\/span>     <\/pre>\n
  23:<\/span>     Switch ($ServiceType ) {<\/pre>\n
  24:<\/span>       1     {\"Kernel-Mode Driver\"<\/span>}<\/pre>\n
  25:<\/span>       2     {\"File System Driver\"<\/span>}<\/pre>\n
  26:<\/span>       4     {\"Adapter Arguments\"<\/span>}<\/pre>\n
  27:<\/span>       8     {\"File System Driver Service\"<\/span>}<\/pre>\n
  28:<\/span>       16    {\"Own Process\"<\/span>}<\/pre>\n
  29:<\/span>       32    {\"Shared Process\"<\/span>}<\/pre>\n
  30:<\/span>       272   {\"Own Process - Interactive\"<\/span>}<\/pre>\n
  31:<\/span>       288   {\"Shared Process - Interactive\"<\/span>}<\/pre>\n
  32:<\/span>       default<\/span>   {\"Unknown\"<\/span>}<\/pre>\n
  33:<\/span>      }<\/pre>\n
  34:<\/span> }<\/pre>\n
  35:<\/span>  <\/pre>\n
  36:<\/span> [ADSI]$svc=\"WinNT:\/\/$computername\/$service,service\"<\/span><\/pre>\n
  37:<\/span>  <\/pre>\n
  38:<\/span> if<\/span> ($svc.name) <\/pre>\n
  39:<\/span> {<\/pre>\n
  40:<\/span>     #connection made to valid service<\/span><\/pre>\n
  41:<\/span>       if<\/span> ($svc.status -eq<\/span> 4) {$status=\"Running\"<\/span>}<\/pre>\n
  42:<\/span>       elseif<\/span> ($svc.status -eq<\/span> 1) {$status=\"Stopped\"<\/span>}<\/pre>\n
  43:<\/span>       else<\/span> {$status=\"Unknown\"<\/span>}<\/pre>\n
  44:<\/span>         <\/pre>\n
  45:<\/span>     $obj=New-Object PSobject<\/pre>\n
  46:<\/span>     <\/pre>\n
  47:<\/span>     $obj | Add-Member NoteProperty \"Computername\"<\/span> $computername.toUpper()<\/pre>\n
  48:<\/span>     $obj | Add-Member NoteProperty \"Service\"<\/span> $svc.name.value<\/pre>\n
  49:<\/span>     $obj | Add-Member NoteProperty \"DisplayName\"<\/span> $svc.displayname.value<\/pre>\n
  50:<\/span>     $obj | Add-Member NoteProperty \"Status\"<\/span> $status <\/pre>\n
  51:<\/span>     $obj | Add-Member NoteProperty \"StartType\"<\/span> (Decode-StartType $svc.startType.value)<\/pre>\n
  52:<\/span>     $obj | Add-Member NoteProperty \"ServiceType\"<\/span> (Decode-ServiceType $svc.servicetype.value)<\/pre>\n
  53:<\/span>     $obj | Add-Member NoteProperty \"ServiceAccount\"<\/span> $svc.serviceaccountname.value <\/pre>\n
  54:<\/span>     $obj | Add-Member NoteProperty \"Path\"<\/span> $svc.Path.Value<\/pre>\n
  55:<\/span>     <\/pre>\n
  56:<\/span>     write $obj<\/pre>\n
  57:<\/span> } <\/pre>\n
  58:<\/span> else<\/span> <\/pre>\n
  59:<\/span> {<\/pre>\n
  60:<\/span>     Write-Warning (\"Failed to find the {0} service on {1}\"<\/span> -f $service,$computername.ToUpper())<\/pre>\n
  61:<\/span> }<\/pre>\n
  62:<\/span>  <\/pre>\n<\/div>\n<\/div>\n
The script creates custom object that uses more admin friendly values.<\/p>\n
PS C:\\> c:\\scripts\\posh\\get-remoteservice -computer godot -service remoteregistry <\/font><\/p>\n
Computername   : GODOT
Service        : remoteregistry
DisplayName    : Remote Registry
Status         : Running
StartType      : Automatic
ServiceType    : Shared Process
ServiceAccount : NT AUTHORITY\\LocalService
Path           : C:\\WINDOWS\\system32\\svchost.exe -k LocalService<\/font><\/p>\n
But what about finding all the services? You can use ADSI for this as well. Try these commands<\/p>\n
PS C:\\> [ADSI]$server=”WinNT:\/\/$env:computername”<\/font><\/p>\n
PS C:\\> $server.psbase.children | Where {$_.class -eq “service”} | format-table Name,Displayname,Status -autosize<\/font><\/p>\n
You can substitute any computername you want. $env:computername will resolve to your computername. Of course the output leaves a little to be desired. Ergo, another script.<\/p>\n
\n
\n
   1:<\/span> #Get-AllRemoteService.ps1<\/span><\/pre>\n
   2:<\/span>  <\/pre>\n
   3:<\/span> param<\/span>([string]$computername=$env:computername)<\/pre>\n
   4:<\/span>  <\/pre>\n
   5:<\/span> function<\/span> Decode-StartType {<\/pre>\n
   6:<\/span>     Param([int]$startType)<\/pre>\n
   7:<\/span>  <\/pre>\n
   8:<\/span>     Switch ($startType) {<\/pre>\n
   9:<\/span>         0    {\"Boot\"<\/span>}<\/pre>\n
  10:<\/span>         1    {\"System\"<\/span>}<\/pre>\n
  11:<\/span>         2    {\"Automatic\"<\/span>}<\/pre>\n
  12:<\/span>         3    {\"Manual\"<\/span>}<\/pre>\n
  13:<\/span>         4    {\"Disabled\"<\/span>}<\/pre>\n
  14:<\/span>        default<\/span>    {\"Unknown:$starttype\"<\/span>}<\/pre>\n
  15:<\/span>     }<\/pre>\n
  16:<\/span> }<\/pre>\n
  17:<\/span>  <\/pre>\n
  18:<\/span> Function Decode-ServiceType {<\/pre>\n
  19:<\/span>     Param([int]$ServiceType)<\/pre>\n
  20:<\/span>     <\/pre>\n
  21:<\/span>     Switch ($ServiceType ) {<\/pre>\n
  22:<\/span>       1     {\"Kernel-Mode Driver\"<\/span>}<\/pre>\n
  23:<\/span>       2     {\"File System Driver\"<\/span>}<\/pre>\n
  24:<\/span>       4     {\"Adapter Arguments\"<\/span>}<\/pre>\n
  25:<\/span>       8     {\"File System Driver Service\"<\/span>}<\/pre>\n
  26:<\/span>       16    {\"Own Process\"<\/span>}<\/pre>\n
  27:<\/span>       32    {\"Shared Process\"<\/span>}<\/pre>\n
  28:<\/span>       272   {\"Own Process - Interactive\"<\/span>}<\/pre>\n
  29:<\/span>       288   {\"Shared Process - Interactive\"<\/span>}<\/pre>\n
  30:<\/span>       default<\/span>   {\"Unknown:$servicetype\"<\/span>}<\/pre>\n
  31:<\/span>      }<\/pre>\n
  32:<\/span> }<\/pre>\n
  33:<\/span>  <\/pre>\n
  34:<\/span> [ADSI]$server=\"WinNT:\/\/$computername\"<\/span><\/pre>\n
  35:<\/span>  <\/pre>\n
  36:<\/span> if<\/span> ($server.name) <\/pre>\n
  37:<\/span> {<\/pre>\n
  38:<\/span> #connection made to valid  server<\/span><\/pre>\n
  39:<\/span> #filter child objects and get services<\/span><\/pre>\n
  40:<\/span>     $services=$server.psbase.children | where {$_.class -eq<\/span> \"service\"<\/span>}<\/pre>\n
  41:<\/span>     <\/pre>\n
  42:<\/span>     foreach<\/span> ($svc in<\/span> $services) {<\/pre>\n
  43:<\/span>         if<\/span> ($svc.status -eq<\/span> 4) {$status=\"Running\"<\/span>}<\/pre>\n
  44:<\/span>         elseif<\/span> ($svc.status -eq<\/span> 1) {$status=\"Stopped\"<\/span>}<\/pre>\n
  45:<\/span>         else<\/span> {$status=\"Unknown\"<\/span>}<\/pre>\n
  46:<\/span>         <\/pre>\n
  47:<\/span>         $obj=New-Object PSobject<\/pre>\n
  48:<\/span>         <\/pre>\n
  49:<\/span>         $obj | Add-Member NoteProperty \"Computername\"<\/span> $computername.toUpper()<\/pre>\n
  50:<\/span>         $obj | Add-Member NoteProperty \"Service\"<\/span> $svc.name.value<\/pre>\n
  51:<\/span>         $obj | Add-Member NoteProperty \"DisplayName\"<\/span> $svc.displayname.value<\/pre>\n
  52:<\/span>         $obj | Add-Member NoteProperty \"Status\"<\/span> $status <\/pre>\n
  53:<\/span>         $obj | Add-Member NoteProperty \"StartType\"<\/span> (Decode-StartType $svc.startType.value)<\/pre>\n
  54:<\/span>         $obj | Add-Member NoteProperty \"ServiceType\"<\/span> (Decode-ServiceType $svc.servicetype.value)<\/pre>\n
  55:<\/span>         $obj | Add-Member NoteProperty \"ServiceAccount\"<\/span> $svc.serviceaccountname.value <\/pre>\n
  56:<\/span>         $obj | Add-Member NoteProperty \"Path\"<\/span> $svc.Path.Value<\/pre>\n
  57:<\/span>         <\/pre>\n
  58:<\/span>         write $obj<\/pre>\n
  59:<\/span>  } #end foreach<\/span><\/pre>\n
  60:<\/span> } #end if <\/span><\/pre>\n
  61:<\/span> else<\/span> <\/pre>\n
  62:<\/span> {<\/pre>\n
  63:<\/span>     Write-Warning (\"Failed to connect to {0}\"<\/span> -f $computername.ToUpper())<\/pre>\n
  64:<\/span> }<\/pre>\n<\/div>\n<\/div>\n
This script merely needs a computername as a parameter. It will default to the localhost.<\/p>\n
PS C:\\Scripts> .\\get-allremoteservice FILE02<\/font><\/p>\n
You’ll get my custom service object for every service on that computer. Of course, because the script is writing an object to the pipeline you can sort, filter, group, export and anything else you’d like to do.<\/p>\n
PS C:\\scripts> .\\get-allremoteservice | where {$_.status -eq “running”} | sort ServiceAccount | format-table -groupby ServiceAccount service,Displayname,StartType,ServiceType<\/font><\/p>\n
Eventually you’ll be able to use Get-Service<\/strong> everywhere (in PowerShell v2.0), but this might be a valuable alternative until then.<\/p>\n
\n
Get both scripts here in a convenient zip file.<\/a><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
The other day I showed you how to use ADSI and PowerShell to manage services on remote computers. Since the ADSI type adapter is admittedly “kludgy” at times, I put together a script that you could use like a cmdlet to retrieve service information via ADSI.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[283,25],"tags":[280,28,57,300],"class_list":["post-684","post","type-post","status-publish","format-standard","hentry","category-howto","category-windows-powershell","tag-adsi","tag-powershell","tag-scripting","tag-service"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/684","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/comments?post=684"}],"version-history":[{"count":1,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/684\/revisions"}],"predecessor-version":[{"id":686,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/684\/revisions\/686"}],"wp:attachment":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/media?parent=684"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/categories?post=684"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/tags?post=684"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}