PowerShell Services Management

A Windows service is a background process managed by the operating system's Service Control Manager (SCM). Services run without requiring an interactive user login session (e.g., Spooler, WinRM, BITS) and are typically started at boot or on demand. PowerShell provides a family of *-Service cmdlets that interact directly with services as System.ServiceProcess.ServiceController objects, allowing administrators to view, start, stop, restart, and configure services on local or remote machines.

Viewing Services with Get-Service

The Get-Service cmdlet queries the Service Control Manager and lists all services registered on the system, along with their current status, name, and display name.

Get-Service

Status   Name               DisplayName
------   ----               -----------
Running  BITS               Background Intelligent Transfer Service
Stopped  Fax                Fax
Running  Spooler            Print Spooler
Running  WinRM              Windows Remote Management (WS-Management)

Getting a Specific Service

Use the -Name parameter to look up a service by its short (internal) name, or -DisplayName to search by its friendly name. Both support wildcards.

Get-Service -Name "Spooler"
Get-Service -DisplayName "*Remote*"

Get-Service -Name "spooler", "wuauserv" | Select-Object -Property Name, DisplayName, Status, StartType

where:

• -Name is the internal service name (e.g., Spooler, WinRM, wuauserv).
• -DisplayName is the human-readable name shown in the Services console; supports wildcards.
• Select-Object filters output properties to show the service identifier, human-readable name, running status, and startup behavior.

./get-service-demo.ps1

Name     DisplayName    Status  StartType
----     -----------    ------  ---------
spooler  Print Spooler  Running Automatic
wuauserv Windows Update Stopped Manual

Starting and Stopping Services

PowerShell includes targeted cmdlets to alter service states: Start-Service, Stop-Service, and Restart-Service. These cmdlets accept input directly from the pipeline.

Start-Service

The Start-Service cmdlet starts a stopped service.

Start-Service -Name "Fax"

where -Name is the service name to start.

Stop-Service

The Stop-Service cmdlet stops a running service.

Stop-Service -Name "Fax"

where -Name is the service name to stop.

Restart-Service

The Restart-Service cmdlet stops a service and then starts it again in one command, which is particularly useful after making configuration changes.

Restart-Service -Name "spooler" -PassThru

where:

• -Name is the service name to restart.
• -PassThru returns the refreshed ServiceController object to the console; by default, lifecycle cmdlets return no output upon success.

./manage-service.ps1

Status   Name               DisplayName
------   ----               -----------
Running  spooler            Print Spooler

Configuring Startup Type with Set-Service

The Set-Service cmdlet modifies service settings in the registry and the Service Control Manager, such as startup type, display names, and descriptions.

Set-Service -Name "wuauserv" -StartupType Manual -PassThru | 
    Select-Object -Property Name, StartType, Status

where:

• -Name is the target service name.
• -StartupType defines how the service initializes when the operating system boots. Accepted values include:
  • Automatic starts at system boot.
  • AutomaticDelayedStart starts shortly after boot to optimize resource allocation.
  • Manual starts only when triggered by an application, dependency, or administrator.
  • Disabled prevents the service from being started under any circumstance.
• -PassThru passes the modified service object back into the pipeline for immediate verification.

./set-service-demo.ps1

Name     StartType  Status
----     ---------  ------
wuauserv    Manual Stopped

You can also set a service's -Status directly and provide a -Description:

Set-Service -Name "Fax" -StartupType Disabled -Status Stopped

Querying and Managing Remote Services

Most *-Service cmdlets support the -ComputerName parameter, allowing you to query services on remote machines without a full remoting session.

Get-Service -Name "WinRM" -ComputerName "SRV01", "SRV02"

where -ComputerName is one or more remote computer names to query.

./check-remote-service.ps1

Status   Name  DisplayName                            PSComputerName
------   ----  -----------                            --------------
Running  WinRM Windows Remote Management (WS-Manag...) SRV01
Running  WinRM Windows Remote Management (WS-Manag...) SRV02

Querying Remote Services with Get-CimInstance

For modern, WS-Management-based querying that works with PowerShell 7+, use Get-CimInstance against the Win32_Service class.

$remoteServer = "Server01"
Get-CimInstance -ClassName Win32_Service -ComputerName $remoteServer -Filter "State = 'Running'" |
    Select-Object -Property Name, DisplayName, StartMode, ProcessId |
    Select-Object -First 3

where:

• Get-CimInstance queries Common Information Model (CIM) providers over standard WS-Management (WinRM) protocols.
• -ClassName Win32_Service is the CIM class representing system services.
• -ComputerName is the hostname or IP address of the remote node.
• -Filter performs server-side SQL/WQL filtering before transmitting results across the network.
• Select-Object -First 3 limits console output to the first three returned instances.

./remote-service-query.ps1

Name          DisplayName                   StartMode ProcessId
----          -----------                   --------- ---------
Appinfo       Application Information       Auto           1148
AudioEndpoint Windows Audio Endpoint Buil…  Auto           1284
Audiosrv      Windows Audio                 Auto           1352

Managing Remote Services via Invoke-Command

For full control over remote services, wrap the service cmdlet in Invoke-Command.

Invoke-Command -ComputerName "SRV01" -ScriptBlock {
    Restart-Service -Name "Spooler" -PassThru
}

where:

• -ComputerName is the target remote machine (requires WinRM enabled).
• -ScriptBlock is the code block executed on the remote machine.

Status   Name     DisplayName        PSComputerName
------   ----     -----------        --------------
Running  Spooler  Print Spooler      SRV01

Practical Administration

Auditing Critical Services Across Servers

A common admin task is verifying that essential services are running across multiple servers.

$criticalServices = "WinRM", "Spooler", "BITS"
$servers = "SRV01", "SRV02"

foreach ($server in $servers) {
    foreach ($service in $criticalServices) {
        $status = Get-Service -Name $service -ComputerName $server -ErrorAction SilentlyContinue
        if ($status.Status -ne "Running") {
            Write-Output "WARNING: $service is $($status.Status) on $server"
        }
    }
}

where:

• $criticalServices is an array of service names to check.
• $servers is an array of remote computer names to audit.
• -ErrorAction SilentlyContinue suppresses errors if a service doesn't exist on a given server.

./audit-critical-services.ps1

WARNING: BITS is Stopped on SRV02

Remediating Failed Automatic Services

A standard sysadmin task involves auditing all services configured to start automatically that are currently stopped, then attempting to restart them.

$failedServices = Get-Service | Where-Object { 
    $_.StartType -eq 'Automatic' -and $_.Status -eq 'Stopped' 
}

foreach ($service in $failedServices) {
    Write-Warning "Service '$($service.DisplayName)' is Stopped. Attempting restart..."
    try {
        Start-Service -Name $service.Name -ErrorAction Stop
        Write-Output "Successfully started $($service.Name)"
    }
    catch {
        Write-Error "Failed to start $($service.Name): $($_.Exception.Message)"
    }
}

where:

• Where-Object evaluates multiple conditional checks simultaneously using -and.
• try / catch is an error handling construct that traps runtime exceptions during service initiation (such as logon failures or missing binary files).
• -ErrorAction Stop converts non-terminating start errors into terminating exceptions caught by the catch block.
• $_.Exception.Message retrieves the exact failure message returned by the Service Control Manager.

./audit-failed-services.ps1

WARNING: Service 'Downloaded Maps Manager' is Stopped. Attempting restart...
Successfully started MapsBroker