Better Windows ServicesAsk the machine a question
One language, in the search box of the window and in bws list --query. A bare word searches the name, the display name, the account and the launch path. A field narrows it. 21 fields, and the same text means the same thing in both halves of the tool.
Five that answer a real question
What should be up and is not
start:auto !status:running
The first query most people write, and the one services.msc cannot answer at all.
Services whose file is gone
file:missing
An entry pointing at a binary that is not on disk. Usually an uninstall that left the registration behind.
Unsigned, without the session noise
signed:no peruser:no
The per-user families make a copy per session and fill a list with near-duplicates. This asks about the rest.
Running although disabled
mismatch:running
Configuration and state that disagree - an entry the manager is set never to start, running anyway.
Anything asking for debug rights
privilege:SeDebugPrivilege
A privilege that lets a process open any other one. Worth knowing which services ask for it.
What the tool could not read
account:?
The entries where this session could not read the account. A question services.msc cannot even ask.
How a query is written
Terms
- Terms are separated by spaces and all of them must match - there is no
andkeyword because there is nothing else it could mean. !in front of a term negates it:!status:running.- A comma inside a field is or:
start:manual,disabled. - Quotes protect anything with spaces or colons:
account:"NT SERVICE\McmSvc".
How text is matched
name:spoolmatches anything containing it - the default, because it is what people expect from a search box.name:=spooleris exact.name:spool*takes wildcards,*and?.name:/^Sql.*/is a regular expression.- Case is ignored, including outside ASCII - a display name in Polish or Greek matches whichever way it is typed.
Three words every field accepts
any- there is a value, whatever it isnone- there is genuinely no value - the entry has none?- the tool could not read this field, which is a questionservices.msccannot even ask
A mistyped value is an error, never an empty result. status:runing answers Did you mean running? and ends with code 2. An empty list would look like an answer, and the difference between "nothing matches" and "you typed it wrong" is the difference between a machine that is clean and an audit that proved nothing. A query that would narrow nothing is refused on the command line too, so a script does not operate on the whole machine because of a typo.
Every field
Built from the program itself, so this table cannot drift from what the tool accepts. A field with no list of values takes text, a number or a size - the third column says which.
| Field | Asks about | Values |
|---|---|---|
name | the service name, the one Windows identifies it by | text |
display | the display name, as this Windows spells it | text |
description | what the entry says about itself | text |
type | what kind of entry it is | driver, kernelDriver, fileSystemDriver, ownProcess, sharedProcess, unknown |
peruser | whether it is one of the per-user families Windows makes a copy of per session | yes, no, template, instance |
status | what it is doing right now | running, stopped, paused, pending, startPending, stopPending, pausePending, continuePending, unknown |
start | what the manager does with it at the next boot | automatic, auto, delayed, manual, disabled, boot, system, unknown |
account | the account it runs as, as the manager spells it | text, e.g. localsystem |
pid | the process it is running in | a number: 1234, >1000, 100-200 |
trigger | a condition that starts or stops it | device, ip, domain, firewall, policy, network, custom, state, unknown, start, stop |
path | the command line the manager launches | text |
file | whether the file it runs is on disk | present, missing |
signed | what Windows thinks of the file's signature | yes, no, trusted, notSigned, untrustedRoot, expired, revoked, tampered, unknown |
publisher | who signed the file | text |
privilege | a privilege the entry asks for | text, e.g. SeDebugPrivilege |
dependson | what this one needs | a service name |
requiredby | what breaks if this one stops | a service name |
sidtype | the service SID type | unrestricted, restricted, unknown |
sddl | the security descriptor, as text | text |
memory | what its process is using | a size with a unit: 500MB, >1GB, 100MB-1GB |
mismatch | configuration and state that disagree | stopped, running |
Two things worth knowing
Some fields are expensive, and asking for them turns the reading on
Signatures take several seconds over a whole machine and memory is a measurement rather than a setting, so neither is read for a listing unless asked. A query that mentions one turns that reading on by itself - you do not have to remember --signatures as well as signed:no. In the window, a query about signatures says the answer is incomplete until they arrive, rather than showing a shorter list as though it were the answer.
A result judged on something unreadable says so
If entries were judged on a field this session could not read, the result carries a line saying how many - because such a result may be missing entries, or holding ones that do not belong. That is the same rule the whole tool keeps: an unsuccessful read is visible in the answer, never swallowed.