Advanced Windows PowerShell Scripting Video Training

Advanced Windows PowerShell Scripting Video Training
Advanced Windows PowerShell Scripting Video Training

Monday, September 5, 2016

Use PowerShell to Determine when Services are Loaded

It is another 100+ day here in Phoenix, but that is OK.  I’m spending the day catching up on projects.  In particular, I’m enhancing my Windows 10 classes.  I’m working on creating a better presentation on the Windows 10 boot sequence and I thought that I would share my code with you. 

Value
Meaning
0
Boot (loaded by kernel loader). Components of the driver stack for the boot (startup) volume must be loaded by the kernel loader.
1
System (loaded by I/O subsystem). Specifies that the driver is loaded at kernel initialization.
2
Automatic (loaded by Service Control Manager). Specifies that the service is loaded or started automatically.
3
Manual. Specifies that the service does not start until the user starts it manually, such as by using Device Manager.
4
Disabled. Specifies that the service should not be started.

These are the start values for services on your client.  For example, if you wanted to know which services started at boot, try this:

Get-ChildItem -Path HKLM:\System\CurrentControlSet\Services |
        ForEach-Object -Process {
            $Name = $_.Name.Replace('HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\',$Null)
            Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\$Name" } |
        Where-Object Start -eq 0 |
        Select-Object -Property PSChildName


Yes, I know. It is a bit ugly.  It works though.  Change the Where-Object filter so you can see when/how services are loaded into memory.  

No comments: