How to find, stop and disable a Windows service using Powershell - windows

I am trying to find a service, stop it and then disable it remotely using Powershell. It can find and stop but cannot disable. For disabling, I have to run the Set-Service command separately. Can it be done in one line?
The following code-snippet will stop the Print Spooler service, but will not disable it:
$ip = "10.10.10.10"
$svc_name = "Spooler"
get-service -ComputerName $ip | Where-Object {$_.Name -eq $svc_name} | Stop-Service | Set-Service -StartupType Disabled
The following code-snippet will stop and disable the Print Spooler service:
$ip = "10.10.10.10"
$svc_name = "Spooler"
get-service -ComputerName $ip | Where-Object {$_.Name -eq $svc_name} | Stop-Service
Set-Service $svc_name -StartupType Disabled
Powershell version is 5.1.14393.2969.
Edit:
The following line will also find and disable. So, it looks like I can give two instructions with pipeline.
get-service -ComputerName $ip | Where-Object {$_.Name -eq $svc_name} | Set-Service -StartupType Disabled

You need to use Set-Service to set the startup type, as outlined in your question:
Set-Service -StartupType Disabled $svc_name
If you want to do it in "one line", you can use the -PassThru argument on Stop-Service to return the service object which can then be sent down the pipeline (you also don't need a Where-Object clause, Get-Service can filter on service name as well):
Get-Service -ComputerName $ip $svc_name | Stop-Service -PassThru | Set-Service -StartupType Disabled
You had this close in your original question, but it didn't work because you didn't use the-PassThru parameter on Stop-Service. As a note, many cmdlets that don't return an object by default do include a -PassThru parameter to return an object that can further processed if necessary, this isn't limited to Stop-Service by any means.

Bender's answer works in PowerShell 5.1, but the -ComputerName parameter was removed from the Get-Service cmdlet in PowerShell 6+. If you're trying to do this in pwsh.exe (i.e. PowerShell 6+), you can use code like the following:
[string[]] $servers = #('server1', 'server2, 'server3')
[scriptblock] $disableServiceScriptBlock = {
[string] $serviceName = 'SERVICE NAME TO DISABLE GOES HERE'
Stop-Service -Name $serviceName
Set-Service -Name $serviceName -StartupType Disabled
}
Invoke-Command -ComputerName $servers -ScriptBlock $disableServiceScriptBlock
Here's a longer code snippet with better error reporting so you know what server an error occurred on:
[string[]] $servers = #('server1', 'server2, 'server3')
[scriptblock] $disableServiceScriptBlock = {
[string] $serviceName = 'SERVICE NAME TO DISABLE GOES HERE'
Stop-Service -Name $serviceName -ErrorVariable stopError -ErrorAction SilentlyContinue
Set-Service -Name $serviceName -StartupType Disabled -ErrorVariable disableError -ErrorAction SilentlyContinue
# If an error occurred, report which server it occurred on with the error message.
[string] $computerName = $Env:ComputerName
if ($stopError)
{
Write-Error "$computerName : Stop Error: $stopError"
}
if ($disableError)
{
Write-Error "$computerName : Disable Error: $disableError"
}
}
Invoke-Command -ComputerName $servers -ScriptBlock $disableServiceScriptBlock

***Stopping both Windows Firewall and Windows Defender Firewall***
$date = get-date -uformat "%m%d%y-%H"
$day = Get-Date -Format yyyyMMdd
$dayold = Get-Date -Format "%M%d%y"
$today = (Get-Date -Format yyyyMMdd)+"-"+(get-date -uformat %H)
$ErrorActionPreference = "SilentlyContinue"
$ServerList = (Get-adcomputer -SearchBase "OU=site,OU=servers,DC=subdomain,DC=domain,DC=root" -filter {name -like "*cont*ext*"} -SearchScope Subtree -Properties Name) |select name
$ServerList=$ServerList.name
(Test-Connection -ComputerName $env:LOGONSERVER.Remove(0,2) -Count 1 -quiet)|Out-Null
foreach ($server in $ServerList){
if(Test-Connection -ComputerName $server -Count 1 -quiet){
$result = (get-service -ComputerName $server -name MpsSvc |select *)
if($result.Status -eq "Running")
{
get-service -ComputerName $server -name MpsSvc |stop-service -Force
get-service -ComputerName $server -name MpsSvc |set-service -ComputerName $server -StartupType Disabled
}
elseif($result.StartType -ne "Disabled"){
set-service -ComputerName $server -name MpsSvc -StartupType "Disabled"
}
$result = (get-service -ComputerName $server -name MpsSvc |select *)
$server+": "+"The "+$result.DisplayName+" is "+$result.Status+" and "+$result.StartType
}
}

Related

Script throwing an error after starting the service

I have written the below code to start the service:
invoke-command -cn $server -Credential $cred -ScriptBlock {
param($svc)
if((get-service $svc).status -ne "running") {
get-service $svc| start-service
set-service $svc -StartupType Automatic
(get-service $svc).waitforstatus('running')
}
get-service $svc| select ServiceName
} -ArgumentList $svc
After executing the above script, I am getting below error:
Status : Running
StartType : Automatic
ServiceName : svcname
PSComputerName : host1
+ invoke-command -cn $server -Credential $cred -ScriptBlock {
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service], ServiceCommandException
+ FullyQualifiedErrorId : StartServiceFailed,Microsoft.PowerShell.Commands.StartServiceCommand
I see service is Running successfully so why it is throwing an error even when the service was started correctly?
I am using poweshell 5
Continuing from my comments, try:
Invoke-Command -ComputerName $server -Credential $cred -ScriptBlock {
param($svc)
$theService = Get-Service -Name $svc
if($theService.Status -ne 'Running') {
if ($theService.Status -ne 'Stopped') { $theService | Stop-Service -Force }
$theService | Set-Service -StartupType Automatic
($theService | Start-Service -PassThru).WaitForStatus('Running')
}
$theService | Select-Object ServiceName
} -ArgumentList $svc

Continue powershell script execution after system restart from last execution point

What i'm trying to do ?
Create four files in local disk in the following order.
Note : In my local machine and not in any server remotely.
Three files to be created
Restart the system
On system startup create another file
Script i have used.
get-job | remove-job -Force
function create-file {
Param ([string] $a)
$p = "D:\" + $a
Write-Host $p
if (!(Test-Path $p))
{
New-Item -path D:\$a -type "file" -value "my new text"
Write-Host "Created new file and text content added"
}
else
{
Add-Content -path D:\$a -value "new text content"
Write-Host "File already exists and new text content added"
}
}
Workflow New-ServerSetup
{
create-file "one.txt"
create-file "two.txt"
create-file "three.txt"
Restart-Computer -ComputerName $env:COMPUTERNAME -Wait
Start-Sleep -Seconds 7
create-file "four.txt"
Unregister-ScheduledJob -Name NewServerSetupResume
}
$adm = "####"
$pwd = ConvertTo-SecureString -String "####" -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential($adm, $pwd)
$AtStartup = New-JobTrigger -AtStartup
Register-ScheduledJob -Name NewServerSetupResume -Credential $cred -Trigger $AtStartup -ScriptBlock {Import-Module PSWorkflow; Get-Job -Name NewSrvSetup -State Suspended | Resume-Job}
New-ServerSetup -JobName NewSrvSetup
Issues i'm facing
The execution returns Cannot wait for local computer to restart
i'm new to powershell things if any mistakes burden me.
Thanks in advance.
Schedule a job first, then reboot without waiting.

POWERSHELL - Variable in Get-service -Name $Var

Here my script :
Relance de Service sur machine distante
Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser -Force
$passwd = ConvertTo-SecureString -AsPlainText -Force -String PASSWORD #Remplacer 'Password' par votre Mot de passe Datacenter
$cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "LOGIN",$passwd #Remplacer 'login' par votre login datacenter
$Server = Read-Host -Prompt 'Veuillez entrer le nom du serveur'
$session = New-PSSession -ComputerName $Server -Credential $cred
$Service = Read-Host -Prompt 'Veuillez entrer le nom du service'
Invoke-Command -Session $session -ScriptBlock {$A = get-service -Name $Service}
if ($A.Status -eq "Stopped") {$A.start()}
elseIf ($A.status -eq "Running") {Write-Host -ForegroundColor Yellow $A.name "is running"}
Get-PSSession | Remove-PSSession
My script is almost working, but i've got an 'error' or i missed something.
When i use prompt to get the server name $Server and put it in the variable everything is ok.
But when i use prompt to get the Service name in a variable $Service, and use get-service -name $Service, it doesn't work.
Why?
Could you help me please?
Your issue is not with Get-Service but with Invoke-Command. The variable $Service you use is not passed from your session to the invoked command. There are multiple options to do this:
By param (as Paxz mentioned in comments):
-ScriptBlock {param($Service) $A = get-service -Name $Service} -ArgumentList $Service
By using::
-ScriptBlock {$A = get-service -Name $using:Service}
By argument directly:
-ScriptBlock {$A = get-service -Name $args[0]} -ArgumentList $Service
Also keep in mind the scope of variables while trying to restart them.
Some useful links to check when it comes to passing variables to remote sessions:
PowerShell: Passing variables to remote commands
How to pass arguments for remote commands

Passing a new value into without changing source file, but adding to install to remote server

Change a value in a winlogbeat.yml as it is passed to serveral remote servers. Here is the value to change > hosts: localhost:5044 and when script kicks off on remote server it is to change to >lp-index-QA.QA.com:9999
Here is the script I wrote.. no failures but does not pass the new value to remote server>>
#ExecutionPolicy
Set-ExecutionPolicy -Force Unrestricted
#DC = (facter datacenter) | Out-String
$DC = 'parpr1'
$QAhost = #("hosts: lp-index-QA.QA.com:9999", "`r`nhosts: localhost:5044")
$PRODhost = #("hosts: lp-index-PROD.PROD.com:9999", "`r`nhosts: localhost:5044")
$file = 'C:\winlogbeat-1.2.3-windows\winlogbeat.yml'
if ($DC -eq "QA")
{
Write-Host "Datacenter is $DC"
Add-Content -PassThru -Path "$file" -Value "hosts: lp-index-QA.QA.com:9999"
}
if ($DC -eq "PROD")
{
Write-Host "Datacenter is $DC"
Add-Content -PassThru -Path "$file" -Value "hosts: lp-index- PROD.PROD.com:9999"
}
# delete service if it already exists
if (Get-Service winlogbeat -ErrorAction SilentlyContinue) {
$service = Get-WmiObject -Class Win32_Service -Filter "name='winlogbeat'"
$service.StopService()
Start-Sleep -s 1
$service.delete()
}
$workdir = Split-Path $MyInvocation.MyCommand.Path
# create new service
New-Service -name winlogbeat `
-displayName winlogbeat `
-binaryPathName "`"$workdir\\winlogbeat.exe`" -c `"$workdir\\winlogbeat.yml`""
#pause 5s
Start-Sleep -s 10
#Startingserver
Start-service winlogbeat

Delete domain profiles older than x days

i need some help in order to complete the script, i have already script which deleting specific profiles on the remote server, but i want o add time frame. Example: if the profile was not used for more than 120 days delete it.
Function Get-OldProfiles {
[CmdletBinding()]
Param(
[Parameter(Mandatory=$True,Position=1)] [string]$computerName
)
PROCESS {
foreach ($computer in $computerName) {
Write-host -ForegroundColor Yellow "Housekeeping on $computer"
Write-host -ForegroundColor Yellow "Mapping drive \\$computer\c$"
$drive = New-PSDrive -Name $computer.replace(".","-") -PSProvider FileSystem -Root \\$computer\C$
Write-host -ForegroundColor Yellow "Checking windows version"
#Cheking windows version
$version = (Get-WmiObject -ComputerName $computer -Class Win32_OperatingSystem).version
Write-host -ForegroundColor Yellow "Windows version $version"
#Profile Deleting area.
if ($version -ge 6) {
Write-host -ForegroundColor Yellow "Getting profiles from WMI"
$profiles = Get-WmiObject -ComputerName $computer Win32_UserProfile -filter "LocalPath Like 'C:\\Users\\%'" | Where-object localpath -Match 'B.{5}R$'| Select-Object {$_.ConvertToDateTime($_.LastUseTime) -lt (Get-Date).AddDays(-2)}
if ($profiles -ne $null) {
$profiles | foreach {
Write-host -ForegroundColor Red ("Deleting profile: " + $_.LocalPath)
#$_.Delete()
}
}
}
}
}
}
I've tried this:
$profiles= Get-WmiObject -ComputerName $computer -class Win32_UserProfile -filter "Special = False -and LocalPath Like 'C:\\Users\\%'" | Where-object localpath -Match 'B.{5}R$' | Where {$_.ConvertToDateTime($_.LastUseTime) -lt (Get-Date).AddDays(-120)}
But it returns an error
Get-WmiObject : Invalid query "select * from Win32_UserProfile where Special = False -and LocalPath Like 'C:\\Users\\%'"
At line:22 char:24 + $profiles= Get-WmiObject -ComputerName $computer -class Win32_UserPr ...
You can't use -and in a WQL-filter, it's just AND. Try:
$profiles = Get-WmiObject -ComputerName $computer -Class Win32_UserProfile -filter "Special = False AND LocalPath Like 'C:\\Users\\%'" |
Where-Object { ($_.localpath -Match 'B.{5}R$') -and ($_.ConvertToDateTime($_.LastUseTime) -lt (Get-Date).AddDays(-120)) }

Resources