Command line reference

list and show

list is the whole machine, narrowed by --query. show is one entry with everything known about it - the signature, the privileges, the security descriptor and the memory, all of them read every time, because over one entry that costs about sixty milliseconds where over the whole machine it costs a second. Fields that are genuinely empty are left out unless you pass --full. A field nobody could read is printed either way, because leaving one out would look like an answer.

stop, start and restart

Each builds a plan and carries it out. --dry-run prints the plan and changes nothing, --dependents puts the services that would break into it as steps of their own, and --timeout says how long one step may go without progress. Drivers are refused rather than attempted, because stopping a kernel driver is often not reversible without a restart.

kill - for a service that will not stop

It asks the service to stop and ends the process behind it only if that does not work, so an entry that stops on its own is never ended. Ending a process takes every other service living in that process with it, whether or not they stopped first, and the preview names them and names the process by number. --force skips the polite step and the preview then shows one step instead of two. --restart brings everything back afterwards.

Windows spells this idea differently. --force on Stop-Service means "even if something depends on it", which is what --dependents does here. That is why this is a verb of its own rather than a switch on stop.

start-type - a setting, not a move

It says what the manager will do with an entry at the next boot, and without --stop it moves nothing: an entry that is running keeps running, one that is stopped stays stopped, and the plan says so. disabled is the one worth pausing over, because it stops the manager starting the entry at all, including on demand for something else that needs it. delayed is automatic, started a little after the other automatic entries - the word start:delayed asks about in a query - and Windows refuses it for an entry in a load order group, which the plan says before anything happens. Each of the four writes whether the entry starts late, as sc.exe does. --stop, beside disabled only, stops the entry in the same plan once the setting is written.

snapshot create and snapshot diff

create always reads signatures and hashes, because a snapshot is kept and compared later and one without them would compare against one with them as though the machine had changed. diff says what changed going from the first file to the second, or from a file to this machine with --live. The snapshot page has the format and the reasoning.

history - who changed it, from the System log

Start type changes and installations out of the System log, newest first, with the account Windows recorded. The first line says how far back the log reaches and whether it was cleared, because a history is only as long as the log. With a name it is that service's start type changes - installations are listed without a name only, because Windows records an installation under the display name and never the service name. An account is named where this machine can name it on its own and shown as its SID otherwise, and start types come in the words Windows wrote.

tool - ready-made answers to common problems

The same tools the window shows on its Tools tab. bws tool lists them and bws tool fix lists the quick fixes: printer, sound, indexing and search, each a restart of one Windows service together with what depends on it, chosen because Microsoft's own troubleshooting pages suggest it. bws tool fix printer is exactly bws restart Spooler --dependents - the same plan, the same output and the same exit codes - and like every command here that changes something it does not ask first, so --dry-run is the way to look before it runs.

license - what is inside the file you downloaded

It reads nothing at all - no service manager, no disk, no network - and answers out of a register compiled into the executable. --components turns the notice into every component with its version, its licence and where it came from. The same set the bill of materials published beside the download carries, because both are rendered from one register, and the reason it is worth having: the program is one self-contained file, so there is nothing beside it for a scanner to read.