Mr. Roboto


It's Windows PowerShell to the rescue, as Mr. Roboto looks for a way to see what services need restarting.

Sometimes services fail and sometimes another administrator may have stopped a service for maintenance or troubleshooting, and just forgot to restart. Reader Tom K. was looking for a way to go through a list of servers and find all services that were configured to run automatically, but had stopped.

My first thought was to write an HTML application using VBScript and Windows Management Instrumentation (WMI). Then I realized this is a perfect situation for Windows PowerShell. Once you have some PowerShell fundamentals under your belt, you can solve this challenge without any scripting. You don't have to install PowerShell on your servers -- you can accomplish everything from your Windows XP or Vista desktop.

I'll start with a basic expression and end with a more complete solution. To understand the basics, open a PowerShell session and try this single-line command:

PS C:\> get-wmiobject -query 
"Select * from win32_service 
where startmode='auto' AND state 

If you have any services set to run automatically, but they aren't, you should get something back. I want to reiterate that this isn't scripting: You're using PowerShell as an interactive console. To connect to a remote machine use this:

PS C:\> get-wmiobject -query 
"Select * from win32_service 
where startmode='auto' AND 
state !='running'" -computer "Server01"

To process the list of servers, we'll leverage the PowerShell pipeline, get the content of a text file and pass the contents to our Get-WMIObject cmdlet:

PS C:\> Get-content servers.txt | 
forEach { get-wmiobject -query 
"Select * from win32_service 
where startmode='auto' AND
 state !='running'" -computer $_}

You need administrative permission on the remote servers, but you can specify alternate credentials. The recommended approach is to save the alternate credential as a PowerShell variable and pass it on when needed like this:

PS C:\> $cred=get-credential 

Enter the password in the dialog box. The credential is stored securely within your PowerShell session and erased when it ends. To use the credential, modify the previous expression:

PS C:\> Get-content servers.txt | 
forEach { get-wmiobject -query 
"Select * from win32_service 
where startmode='auto' AND state
 !='running'" -computer $_ 
 -credential $cred}

Remember, you can't use alternate credentials for the local system. If you get several results, you probably can't tell which service goes with which server. All we have to do is give PowerShell some formatting instructions on what to display:

PS C:\> Get-content servers.txt | 
forEach { get-wmiobject -query 
"Select * from win32_service 
where startmode='auto' AND 
state !='running'" -computer $_} | 

While this should solve Tom's initial request, I've gone ahead and created a filtering function called Show-Stopped. You can run this function on the local machine like this:

PS C:\> show-stopped
ExitCode  : 0
Name      : LVSrvLauncher
ProcessId : 0
StartMode : Auto
State     : Stopped
Status    : OK

Because the function writes a Win32_Service object to the pipeline, you can access any of its properties. This example will give you a nicely formatted report. This function can also use an alternate credential, although you'll have to create it ahead of time, and it will use it for every server it processes:

PS C:\> cred=get-
credential "domain\admin"
PS C:\> get-content servers.txt | 
show-stopped $cred | Format-List 

Each server in servers.txt is piped to the function and makes a WMI connection with the alternate credential. The output is piped to Format-List. Because objects are coming out of the pipeline, you can write them to a file, send them a printer, format as HTML, e-mail or export.

Once you spend a little time with PowerShell, you'll quickly realize its value. I certainly hope my new friend Tom does as well.

About the Author

Jeffery Hicks is an IT veteran with over 25 years of experience, much of it spent as an IT infrastructure consultant specializing in Microsoft server technologies with an emphasis in automation and efficiency. He is a multi-year recipient of the Microsoft MVP Award in Windows PowerShell. He works today as an independent author, trainer and consultant. Jeff has written for numerous online sites and print publications, is a contributing editor at, and a frequent speaker at technology conferences and user groups.


  • Vendors Issue Patches for Linux Container Runtime Flaw Enabling Host Attacks

    This week, the National Institute of Standards and Technology (NIST) described a high-risk security vulnerability (CVE-2019-5736) for organizations using containers that could lead to compromised host systems.

  • Windows 10 Version 1809 Users May Get Visual Studio Crashes

    Microsoft on Friday issued an advisory for Windows 10 version 1809 users about possible Visual Studio crashes.

  • Standardizing the Look of Outlook's Outbound Messages

    Microsoft typically gives users a blank canvas to compose new e-mails in Outlook. In some corporate environments, however, a blank canvas isn't a good thing.

  • Windows 10 'Semiannual Channel Targeted' Goes Away This Spring

    Microsoft plans to slightly alter its Windows servicing lingo and management behavior with its next Windows 10 operating system feature update release, coming this spring.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.