Edit

Share via

Win32_Service class

  • Article

The Win32_Service WMI class represents a service on a computer system running Windows.

The following syntax is simplified from Managed Object Format (MOF) code and includes all of the inherited properties. Properties and methods are in alphabetic order, not MOF order.

Syntax

[Dynamic, Provider("CIMWin32"), SupportsUpdate, UUID("{8502C4D9-5FBB-11D2-AAC1-006008C78BC7}"), DisplayName("Services"), AMENDMENT]
class Win32_Service : Win32_BaseService
{
  boolean  AcceptPause;
  boolean  AcceptStop;
  string   Caption;
  uint32   CheckPoint;
  string   CreationClassName;
  boolean  DelayedAutoStart;
  string   Description;
  boolean  DesktopInteract;
  string   DisplayName;
  string   ErrorControl;
  uint32   ExitCode;
  datetime InstallDate;
  string   Name;
  string   PathName;
  uint32   ProcessId;
  uint32   ServiceSpecificExitCode;
  string   ServiceType;
  boolean  Started;
  string   StartMode;
  string   StartName;
  string   State;
  string   Status;
  string   SystemCreationClassName;
  string   SystemName;
  uint32   TagId;
  uint32   WaitHint;
};

Members

The Win32_Service class has these types of members:

Methods

The Win32_Service class has these methods.

Method Description
Change Modifies a service.
ChangeStartMode Modifies the start mode of a service.
Create Creates a new service.
Delete Deletes an existing service.
GetSecurityDescriptor Returns the security descriptor that controls access to the service.
InterrogateService Requests that a service update its state to the service manager.
PauseService Attempts to place a service in the paused state.
ResumeService Attempts to place a service in the resumed state.
SetSecurityDescriptor Writes an updated version of the security descriptor that controls access to the service.
StartService Attempts to place a service into the startup state.
StopService Places a service in the stopped state.
UserControlService Attempts to send a user-defined control code to a service.

 

Properties

The Win32_Service class has these properties.

AcceptPause

Data type: boolean

Access type: Read-only

Qualifiers: MappingStrings ("Win32API|Service Structures|SERVICE_STATUS|dwControlsAccepted|SERVICE_ACCEPT_PAUSE_CONTINUE"), DisplayName ("Service Accepts Pause")

Indicates whether the service can be paused.

This property is inherited from Win32_BaseService.

AcceptStop

Data type: boolean

Access type: Read-only

Qualifiers: MappingStrings ("Win32API|Service Structures|SERVICE_STATUS|dwControlsAccepted|SERVICE_ACCEPT_STOP"), DisplayName ("Service Accepts Stop")

Indicates whether the service can be stopped.

This property is inherited from Win32_BaseService.

Caption

Data type: string

Access type: Read-only

Qualifiers: MaxLen (64), DisplayName ("Caption")

Short description of the service —a one-line string.

This property is inherited from CIM_ManagedSystemElement.

CheckPoint

Data type: uint32

Access type: Read-only

Qualifiers: MappingStrings ("Win32API|Service Structures|SERVICE_STATUS|dwCheckPoint"), DisplayName ("Check Point Count")

Value that the service increments periodically to report its progress during a long start, stop, pause, or continue operation. For example, the service increments this value as it completes each step of its initialization when it is starting up. The user interface program that invokes the operation on the service uses this value to track the progress of the service during a lengthy operation. This value is not valid and should be zero when the service does not have a start, stop, pause, or continue operation pending.

CreationClassName

Data type: string

Access type: Read-only

Qualifiers: CIM_Key, DisplayName ("Class Name")

Name of the first concrete class to appear in the inheritance chain used in the creation of an instance. When used with the other key properties of the class, this property allows all instances of this class and its subclasses to be uniquely identified.

This property is inherited from CIM_Service.

DelayedAutoStart

Data type: boolean

Access type: Read-only

Qualifiers: MappingStrings ("Win32API|Service Structures|SERVICE_DELAYED_AUTO_START_INFO|fDelayedAutostart"), DisplayName ("Delayed Auto-Start")

If True, the service is started after other auto-start services are started plus a short delay.

Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows 8, Windows Server 2008 R2, Windows 7, Windows Server 2008 and Windows Vista: This property is not supported before Windows Server 2016 and Windows 10.

Description

Data type: string

Access type: Read-only

Qualifiers: DisplayName ("Description")

Description of the object.

This property is inherited from CIM_ManagedSystemElement.

DesktopInteract

Data type: boolean

Access type: Read-only

Qualifiers: MappingStrings ("Win32API|Service Structures|QUERY_SERVICE_CONFIG|dwServiceType|SERVICE_INTERACTIVE_PROCESS"), DisplayName ("Interacts With Desktop")

Indicates whether the service can create or communicate with windows on the desktop, and thus interact in some way with a user. Interactive services must run under the Local System account. Most services are not interactive; that is, they do not communicate with the user in any way.

This property is inherited from Win32_BaseService.

DisplayName

Data type: string

Access type: Read-only

Qualifiers: MappingStrings ("Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpDisplayName"), DisplayName ("Display Name")

Name of the service as viewed in the Services snap-in. This string has a maximum length of 256 characters. Note that the display name and the service name (which is stored in the registry) are not always the same. For example, the DHCP Client service has the service name Dhcp but the display name DHCP Client. The name is case-preserved in the Service Control Manager. However, DisplayName comparisons are always case-insensitive.

Constraint: Accepts the same value as the Name property.

Example: "Atdisk"

This property is inherited from Win32_BaseService.

ErrorControl

Data type: string

Access type: Read-only

Qualifiers: MappingStrings ("Win32API|Service Structures|QUERY_SERVICE_CONFIG|dwErrorControl"), DisplayName ("Severity Of Startup Failure")

Severity of the error if this service fails to start during startup. The value indicates the action taken by the startup program if failure occurs. All errors are logged by the computer system.

Ignore ("Ignore")

User is not notified.

Normal ("Normal")

User is notified. Usually this will be a message box display notifying the user of the problem.

Severe ("Severe")

System is restarted with the last-known-good configuration.

Critical ("Critical")

System attempts to restart with a good configuration. If the service fails to start a second time, startup fails.

Unknown ("Unknown")

Severity of the error is unknown.

This property is inherited from Win32_BaseService.

ExitCode

Data type: uint32

Access type: Read-only

Qualifiers: MappingStrings ("Win32API|Service Structures|SERVICE_STATUS|dwWin32ExitCode"), DisplayName ("Exit Code")

Windows error code that defines errors encountered in starting or stopping the service. This property is set to ERROR_SERVICE_SPECIFIC_ERROR (1066) when the error is unique to the service represented by this class, and information about the error is available in the ServiceSpecificExitCode property. The service sets this value to NO_ERROR when running, and again upon normal termination.

This property is inherited from Win32_BaseService.

InstallDate

Data type: datetime

Access type: Read-only

Qualifiers: MappingStrings ("MIF.DMTF|ComponentID|001.5"), DisplayName ("Install Date")

Date object is installed. This property does not require a value to indicate that the object is installed.

This property is inherited from CIM_ManagedSystemElement.

Name

Data type: string

Access type: Read-only

Qualifiers: Key

Unique identifier of the service that provides an indication of the functionality that is managed. This functionality is described in the Description property of the object.

This property is inherited from CIM_ManagedSystemElement.

PathName

Data type: string

Access type: Read-only

Qualifiers: MappingStrings ("Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpBinaryPathName"), DisplayName ("File Path Name")

Fully qualified path to the service binary file that implements the service.

Example: "\SystemRoot\System32\drivers\afd.sys"

This property is inherited from Win32_BaseService.

ProcessId

Data type: uint32

Access type: Read-only

Qualifiers: MappingStrings ("Win32API|Service Structures|SERVICE_STATUS_PROCESS|dwProcessId"), DisplayName ("Process Id")

Process identifier of the service.

Example: 324

ServiceSpecificExitCode

Data type: uint32

Access type: Read-only

Qualifiers: MappingStrings ("Win32API|Service Structures|SERVICE_STATUS|dwServiceSpecificExitCode"), DisplayName ("Server Specific Exit Code")

Service-specific error code for errors that occur while the service is either starting or stopping. The exit codes are defined by the service represented by this class. This value is only set when the ExitCode property value is ERROR_SERVICE_SPECIFIC_ERROR (1066).

This property is inherited from Win32_BaseService.

ServiceType

Data type: string

Access type: Read-only

Qualifiers: MappingStrings ("Win32API|Service Structures|QUERY_SERVICE_CONFIG|dwServiceType"), DisplayName ("Service Type")

Type of service provided to calling processes.

The values are:

Kernel Driver ("Kernel Driver")

File System Driver ("File System Driver")

Adapter ("Adapter")

Recognizer Driver ("Recognizer Driver")

Own Process ("Own Process")

Share Process ("Share Process")

Interactive Process ("Interactive Process")

This property is inherited from Win32_BaseService.

Started

Data type: boolean

Access type: Read-only

Qualifiers: DisplayName ("Started")

Indicates whether or not the service is started.

This property is inherited from CIM_Service.

StartMode

Data type: string

Access type: Read-only

Qualifiers: DisplayName ("Start Mode")

Start mode of the Windows base service.

Boot ("Boot")

Device driver started by the operating system loader (valid only for driver services).

System ("System")

Device driver started by the operating system initialization process. This value is valid only for driver services.

Auto ("Auto")

Service to be started automatically by the service control manager during system startup. Auto services are started even if a user does not log on.

Manual ("Manual")

Service to be started by the Service Control Manager when a process calls the StartService method. These services do not start unless a user logs on and starts them.

Disabled ("Disabled")

Service that cannot be started until its StartMode is changed to either Auto or Manual.

This property is inherited from CIM_Service.

StartName

Data type: string

Access type: Read-only

Qualifiers: MappingStrings ("Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpServiceStartName"), DisplayName ("Starting Account Name")

Account name under which a service runs. Depending on the service type, the account name may be in the form of "DomainName\Username" or UPN format ("Username@DomainName"). The service process is logged by using one of these two forms when it runs. If the account belongs to the built-in domain, then ".\Username" can be specified. For kernel or system-level drivers, StartName contains the driver object name (that is, "\FileSystem\Rdr" or "\Driver\Xns") which the I/O system uses to load the device driver. Additionally, if NULL is specified, the driver runs with a default object name created by the I/O system based on the service name.

Example: "DWDOM\Admin"

This property is inherited from Win32_BaseService.

State

Data type: string

Access type: Read/write

Qualifiers: MappingStrings ("Win32API|Service Structures|SERVICE_STATUS|dwCurrentState "), DisplayName ("State")

Current state of the base service.

The values are:

Stopped ("Stopped")

Start Pending ("Start Pending")

Stop Pending ("Stop Pending")

Running ("Running")

Continue Pending ("Continue Pending")

Pause Pending ("Pause Pending")

Paused ("Paused")

Unknown ("Unknown")

Windows Server 2008 and Windows Vista: This property is read-only before Windows 7 and Windows Server 2008 R2.

This property is inherited from Win32_BaseService.

Status

Data type: string

Access type: Read-only

Qualifiers: MaxLen (10), DisplayName ("Status")

Current status of the object. Various operational and nonoperational statuses can be defined. Operational statuses include: "OK", "Degraded", and "Pred Fail" (an element, such as a SMART-enabled hard disk drive, may be functioning properly but predicting a failure in the near future). Nonoperational statuses include: "Error", "Starting", "Stopping", and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is online, yet the managed element is neither "OK" nor in one of the other states.

This property is inherited from CIM_ManagedSystemElement.

The values are:

OK ("OK")

Error ("Error")

Degraded ("Degraded")

Unknown ("Unknown")

Pred Fail ("Pred Fail")

Starting ("Starting")

Stopping ("Stopping")

Service ("Service")

Stressed ("Stressed")

NonRecover ("NonRecover")

No Contact ("No Contact")

Lost Comm ("Lost Comm")

SystemCreationClassName

Data type: string

Access type: Read-only

Qualifiers: Propagated ("CIM_System.CreationClassName"), CIM_Key, DisplayName ("System Class Name")

Type name of the system that hosts this service.

This property is inherited from CIM_Service.

SystemName

Data type: string

Access type: Read-only

Qualifiers: Propagated ("CIM_System.Name"), CIM_Key, DisplayName ("System Name")

Name of the system that hosts this service.

This property is inherited from CIM_Service.

TagId

Data type: uint32

Access type: Read-only

Qualifiers: MappingStrings ("Win32API|Service Structures|QUERY_SERVICE_CONFIG|dwTagId"), DisplayName ("Tag Id")

Unique tag value for this service in the group. A value of 0 (zero) indicates that the service does not have a tag. A tag can be used to order service startup within a load order group by specifying a tag order vector in the registry located at:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\    GroupOrderList

Tags are only evaluated for Kernel Driver and File System Driver start type services that have Boot or System start modes.

This property is inherited from Win32_BaseService.

WaitHint

Data type: uint32

Access type: Read-only

Qualifiers: MappingStrings ("Win32API|Service Structures|SERVICE_STATUS|dwWaitHint"), DisplayName ("Estimated Wait Time")

Estimated time required, in milliseconds, for a pending start, stop, pause, or continue operation. After the specified time has elapsed, the service makes its next call to the SetServiceStatus method with either an incremented CheckPoint value or a change in CurrentState. If the amount of time specified by WaitHint passes, and CheckPoint has not been incremented, or CurrentState has not changed, the service control manager or service control program assumes that an error has occurred.

Remarks

The Win32_Service class is derived from Win32_BaseService.

The way in which you manage a specific computer depends greatly on the role that computer plays. For example, you generally monitor different aspects of a DNS server than a DHCP server. Although no single property can tell you whether a particular computer is a database server, an e-mail server, or a multimedia server, you can often identify the role a computer plays by identifying the services installed on it.

In large organizations, only one of the major services (such as e-mail) is likely to be installed on a single computer. It would be unusual for a mail server to also perform as a server for Microsoft® Windows Media® technologies player files. Because of this, identifying a service installed on a computer can help identify the computer's role in the network. If the Microsoft® Exchange Server service is installed and running on a computer, it is generally safe to assume that this computer functions as a mail server.

You can use the WMI Win32_Service class to enumerate the services installed on a computer. In addition, you can use this class to determine whether those services are currently running and to return any other required information about that service and how it has been configured.

A service application conforms to the interface rules of the Service Control Manager (SCM), and can be started by a user automatically at system start through the Services control panel utility, or by an application that uses the service functions included in the Windows API. Services can start when there are no users logged on to the computer.

A user connecting from a remote computer must have the SC_MANAGER_CONNECT privilege enabled to be able to enumerate this class. For more information, see Service Security and Access Rights.

Examples

The following VBScript code sample displays all currently installed services.

for each Service in _ 
    GetObject("winmgmts:").InstancesOf ("Win32_Service")
 WScript.Echo ""
 WScript.Echo Service.Name

 description = Service.Description 
 if IsNull(description) then description = "<No description>"

 pathName = Service.PathName
 if IsNull(pathName) then pathName = "<No path>"

 startName = Service.StartName
 if IsNull(startName) then startName = "<None>"

 WScript.Echo "  Description:  ", description
 WScript.Echo "  Executable:   ", pathName
 WScript.Echo "  Status:       ", Service.Status
 WScript.Echo "  State:        ", Service.State
 WScript.Echo "  Start Mode:   ", Service.StartMode
 Wscript.Echo "  Start Name:   ", startName
next

The following VBScript code sample describes the paused, running, and stopped services on the specified computer.

On Error Resume Next
 StateString = "Paused,Running,Stopped"
 StateArray = Split(StateString, ",", -1, 1) 
 ComputerName = InputBox("Enter the computer name", "List Service", "localhost")

 For x = 0 to Ubound (StateArray)
 Set Services = GetObject("winmgmts:\\" & ComputerName & "\Root\CIMv2").ExecQuery("SELECT * FROM Win32_Service where State='" & StateArray(x) & "'")
 
 For Each Service in Services
  SList = SList & Service.Name & VBlf 
 Next

 WScript.Echo StateArray(x) & " Services: " & VBlf & SList
 SList = ""

Next

The following Perl script demonstrates how to retrieve a list of running services from instances of Win32_Service.

use strict;
use Win32::OLE;

my ( $ServiceSet, $Service );

eval { $ServiceSet = Win32::OLE->GetObject("winmgmts:{impersonationLevel=impersonate}!\\\\.\\Root\\CIMv2")->
 ExecQuery("SELECT * FROM Win32_Service WHERE State=\"Running\""); };
unless ($@)
{
 print "\n";
 foreach $Service (in $ServiceSet) 
 {
  print $Service->{Name}, "\n";
  if( $Service->{Description} ) 
   {
    print "  $Service->{Description}\n";
   }
  else
   {
    print "  <No description>\n";
   }
  print "  Process ID: ", $Service->{ProcessId}, "\n";
  print "  Start Mode: ", $Service->{StartMode}, "\n";
  print "\n";
 }
}
else
{
 print STDERR Win32::OLE->LastError, "\n";
}

The following c# sample uses Microsoft.Management.Infrastructure to retrieve all the running services on the local machine.

static void QueryInstanceFunc()
        {
 
            CimSession session = CimSession.Create("localHost");
            IEnumerable<CimInstance> queryInstance = session.QueryInstances(@"root\cimv2", "WQL", "SELECT * FROM Win32_Service");

            foreach (CimInstance cimObj in queryInstance)
            {
                Console.WriteLine(cimObj.CimInstanceProperties["Name"].ToString());
                Console.WriteLine(cimObj.CimInstanceProperties["State"].ToString());
                Console.WriteLine(cimObj.CimInstanceProperties["Status"].ToString());
                
                //Console.WriteLine(cimObj.CimInstanceProperties["NetworkAddress"].ToString());
                Console.WriteLine();

            }

            Console.ReadLine();
        }

The following C# code sample uses System.Management namespace to retrieve all running services on the local machine.

Note

System.Management contains the original classes used to access WMI; however, they are considered slower and generally do not scale as well as their Microsoft.Management.Infrastructure counterparts.

 

using System.Management;
...
        static void oldSchoolQueryInstanceFunc()
        {

            ObjectQuery query = new ObjectQuery("SELECT * FROM Win32_Service");
            ManagementObjectSearcher searcher = new ManagementObjectSearcher(query);


            ManagementObjectCollection queryCollection = searcher.Get();
            foreach (ManagementObject m in queryCollection)
            {
                Console.WriteLine("ServiceName : {0}", m["Name"]);
                Console.WriteLine("State : {0}", m["State"]);
                Console.WriteLine("Status : {0}", m["Status"]);
                Console.WriteLine();
            }

            Console.ReadLine();


        }

Requirements

Requirement Value
Minimum supported client
 Windows Vista
Minimum supported server
 Windows Server 2008
Namespace
 Root\CIMV2
MOF
CIMWin32.mof
DLL
CIMWin32.dll

See also

Win32_BaseService

Operating System Classes

WMI Tasks: Services