Win32_Service

Win32_Service represents a service on a computer system running Windows.

There is one instance of Win32_Service per installed service, regardless of service state. A service is a program that runs silently in the background, similar to a daemon on unix systems.

Examples

To list all services, run this:

Get-CimInstance -ClassName Win32_Service

By default, PowerShell returns a subset of all available properties. To view all available properties, use Select-Object. This command returns all available properties:

Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -Property *

Services can be listed with Get-Service however WMI provides much more detail about services. You might want to compare the output:

Get-Service | Select-Object -Property * | Out-GridView -Title 'Get-Service'
Get-CimInstance -ClassName Win32_Service | Select-Object -Property * | Out-GridView -Title 'WMI'

As you’ll see, Get-Service lacks detailed information about the underlying process that runs the service, and many more details. To explore the returned information, you may want to dump one (random) service with all of its properties:

Get-CimInstance -ClassName Win32_Service | Select-Object -Property * -First 1
Sample results
Name                    : AdobeARMservice
Status                  : OK
ExitCode                : 0
DesktopInteract         : False
ErrorControl            : Ignore
PathName                : "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
ServiceType             : Own Process
StartMode               : Auto
Caption                 : Adobe Acrobat Update Service
Description             : Adobe Acrobat Updater keeps your Adobe software up to date.
InstallDate             :
CreationClassName       : Win32_Service
Started                 : True
SystemCreationClassName : Win32_ComputerSystem
SystemName              : DELL7390
AcceptPause             : False
AcceptStop              : True
DisplayName             : Adobe Acrobat Update Service
ServiceSpecificExitCode : 0
StartName               : LocalSystem
State                   : Running
TagId                   : 0
CheckPoint              : 0
DelayedAutoStart        : False
ProcessId               : 4244
WaitHint                : 0
PSComputerName          :
CimClass                : root/cimv2:Win32_Service
CimInstanceProperties   : {Caption, Description, InstallDate, Name...}
CimSystemProperties     : Microsoft.Management.Infrastructure.CimSystemProperties

From the list of all available properties, select the ones that you find interesting, for example:

Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, Caption, Description, Started

The result looks similar to this:

Name            Caption                           Description
----            -------                           -----------
AdobeARMservice Adobe Acrobat Update Service      Adobe Acrobat Updater keeps your Adobe software up to date.
AJRouter        AllJoyn Router Service            Routes AllJoyn messages for the local AllJoyn clients. If this service is stopped the AllJoyn clients that do not have their own bundle...
ALG             Application Layer Gateway Service Provides support for 3rd party protocol plug-ins for Internet Connection Sharing
AppIDSvc        Application Identity              Determines and verifies the identity of an application. Disabling this service will prevent AppLocker from being enforced.
...

Service State Information

To get information about service details and state, run this:

$stateProps = 'Name', 'Status', 'State', 'PathName'

Get-CimInstance -ClassName Win32_Service | Select-Object -Property $stateProps

The result looks similar to this:

Name            Status State   PathName
----            ------ -----   --------
AdobeARMservice OK     Running "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
AJRouter        OK     Stopped C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
ALG             OK     Stopped C:\Windows\System32\alg.exe
AppIDSvc        OK     Stopped C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
...

Identifying Failed Services

With queries, you can identify services that match certain criteria. For example, services with a StartMode set to Auto should either be running or show an ExitCode of 0:

# finding autostart services in error state:
Get-CimInstance -Query 'Select * from Win32_Service where StartMode = "Auto" and (State <> "Running" and ExitCode>0)'

You will receive nothing when there are no services in error state. To check the code, you may want to relax the query and for example search for any autostart service that is no longer running:

Get-CimInstance -Query 'Select * from Win32_Service where StartMode = "Auto" and State <> "Running"' | Select-Object -Property Name, ExitCode

This should yield a list of autostart services that have successfully completed and are no longer running.

Remote Access

To access remote system(s), use the parameter -ComputerName:

Get-CimInstance -ClassName Win32_Service -ComputerName webserver12

Learn more about accessing remote computers.

Get-Service also provides a list of installed services but provides much less detail.

Methods

Win32_Service has 11 methods:
Method Description
Change Modifies a service.
ChangeStartMode Modifies the start mode of a service.
Delete Deletes an existing service.
GetSecurityDescriptor Returns the security descriptor that controls access to the service.
InterrogateService Requests that a service update its state to the service manager.
PauseService Attempts to place a service in the paused state.
ResumeService Attempts to place a service in the resumed state.
SetSecurityDescriptor Writes an updated version of the security descriptor that controls access to the service.
StartService Attempts to place a service into the startup state.
StopService Places a service in the stopped state.
UserControlService Attempts to send a user-defined control code to a service.

Learn more about Invoke-CimMethod and how to invoke commands. Click any of the methods listed above to learn more about their purpose, parameters, and return value.

Properties

Win32_Service returns 26 properties:

'AcceptPause','AcceptStop','Caption','CheckPoint','CreationClassName',
'DelayedAutoStart','Description','DesktopInteract','DisplayName','ErrorControl','ExitCode','InstallDate',
'Name','PathName','ProcessId','ServiceSpecificExitCode','ServiceType','Started','StartMode',
'StartName','State','Status','SystemCreationClassName','SystemName','TagId','WaitHint'

Unless explicitly marked as WRITEABLE, all properties are read-only.

AcceptPause

BOOL

Indicates whether the service can be paused.

# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, AcceptPause

# filtering all instances with AcceptPause set to $true:
Get-CimInstance -ClassName Win32_Service | Where-Object AcceptPause -eq $true | Select-Object -Property Name, AcceptPause

AcceptStop

BOOL

Indicates whether the service can be stopped.

# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, AcceptStop

# filtering all instances with AcceptStop set to $true:
Get-CimInstance -ClassName Win32_Service | Where-Object AcceptStop -eq $true | Select-Object -Property Name, AcceptStop

Caption

STRING MAX 64 CHAR

Short description of the service - a one-line string.

# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, Caption

# reading property value:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, Caption | Foreach-Object {

  $caption = $_.Caption
  $value = $_.Caption
  "${caption}: Caption = $value"
}

CheckPoint

UINT32

Value that the service increments periodically to report its progress during a long start, stop, pause, or continue operation. For example, the service increments this value as it completes each step of its initialization when it is starting up. The user interface program that invokes the operation on the service uses this value to track the progress of the service during a lengthy operation. This value is not valid and should be zero when the service does not have a start, stop, pause, or continue operation pending.

# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, CheckPoint

# reading property value:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, CheckPoint | Foreach-Object {

  $caption = $_.Caption
  $value = $_.CheckPoint
  "${caption}: CheckPoint = $value"
}

CreationClassName

STRING

Name of the first concrete class to appear in the inheritance chain used in the creation of an instance. When used with the other key properties of the class, this property allows all instances of this class and its subclasses to be uniquely identified.

# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, CreationClassName

# reading property value:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, CreationClassName | Foreach-Object {

  $caption = $_.Caption
  $value = $_.CreationClassName
  "${caption}: CreationClassName = $value"
}

DelayedAutoStart

BOOL

If $true, the service is started after other auto-start services are started plus a short delay.

This property is not supported before Windows Server® 2016 and Windows® 10.

# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, DelayedAutoStart

# filtering all instances with DelayedAutoStart set to $true:
Get-CimInstance -ClassName Win32_Service | Where-Object DelayedAutoStart -eq $true | Select-Object -Property Name, DelayedAutoStart

Description

STRING

Description of the object.

# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, Description

# reading property value:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, Description | Foreach-Object {

  $caption = $_.Caption
  $value = $_.Description
  "${caption}: Description = $value"
}

DesktopInteract

BOOL

Indicates whether the service can create or communicate with windows on the desktop, and thus interact in some way with a user. Interactive services must run under the Local System account. Most services are not interactive; that is, they do not communicate with the user in any way.

# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, DesktopInteract

# filtering all instances with DesktopInteract set to $true:
Get-CimInstance -ClassName Win32_Service | Where-Object DesktopInteract -eq $true | Select-Object -Property Name, DesktopInteract

DisplayName

STRING

Name of the service as viewed in the Services snap-in. This string has a maximum length of 256 characters. Note that the display name and the service name (which is stored in the registry) are not always the same.

For example, the DHCP Client service has the service name Dhcp but the display name DHCP Client. The name is case-preserved in the Service Control Manager. However, DisplayName comparisons are always case-insensitive.

Constraint: Accepts the same value as the Name property.

Example: “Atdisk”

# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, DisplayName

# reading property value:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, DisplayName | Foreach-Object {

  $caption = $_.Caption
  $value = $_.DisplayName
  "${caption}: DisplayName = $value"
}

ErrorControl

STRING

Severity of the error if this service fails to start during startup. The value indicates the action taken by the startup program if failure occurs. All errors are logged by the computer system.

Value Description
Ignore User is not notified.
Normal User is notified. Usually this will be a message box display notifying the user of the problem.
Severe System is restarted with the last-known-good configuration.
Critical System attempts to restart with a good configuration. If the service fails to start a second time, startup fails.
Unknown Severity of the error is unknown.

Available values:

'Ignore', 'Normal', 'Severe', 'Critical', 'Unknown'
# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, ErrorControl

# reading property value:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, ErrorControl | Foreach-Object {

  $caption = $_.Caption
  $value = $_.ErrorControl
  "${caption}: ErrorControl = $value"
}

ExitCode

UINT32

Windows error code that defines errors encountered in starting or stopping the service.

This property is set to ERROR_SERVICE_SPECIFIC_ERROR (1066) when the error is unique to the service represented by this class, and information about the error is available in the ServiceSpecificExitCode property. The service sets this value to NO_ERROR when running, and again upon normal termination.

# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, ExitCode

# reading property value:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, ExitCode | Foreach-Object {

  $caption = $_.Caption
  $value = $_.ExitCode
  "${caption}: ExitCode = $value"
}

InstallDate

DATETIME

Date object is installed. This property can be empty.

# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, InstallDate

# reading property value:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, InstallDate | Foreach-Object {

  $caption = $_.Caption
  $value = $_.InstallDate
  "${caption}: InstallDate = $value"
}

Name

KEY PROPERTY STRING

Unique identifier of the service that provides an indication of the functionality that is managed. This functionality is described in the Description property of the object.

# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name

# reading property value:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, Name | Foreach-Object {

  $caption = $_.Caption
  $value = $_.Name
  "${caption}: Name = $value"
}

PathName

STRING

Fully qualified path to the service binary file that implements the service.

Example: “\SystemRoot\System32\drivers\afd.sys”

# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, PathName

# reading property value:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, PathName | Foreach-Object {

  $caption = $_.Caption
  $value = $_.PathName
  "${caption}: PathName = $value"
}

ProcessId

UINT32

Process identifier of the service.

Example: 324

# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, ProcessId

# reading property value:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, ProcessId | Foreach-Object {

  $caption = $_.Caption
  $value = $_.ProcessId
  "${caption}: ProcessId = $value"
}

ServiceSpecificExitCode

UINT32

Service-specific error code for errors that occur while the service is either starting or stopping.

The exit codes are defined by the service represented by this class. This value is only set when the ExitCode property value is ERROR_SERVICE_SPECIFIC_ERROR (1066).

# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, ServiceSpecificExitCode

# reading property value:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, ServiceSpecificExitCode | Foreach-Object {

  $caption = $_.Caption
  $value = $_.ServiceSpecificExitCode
  "${caption}: ServiceSpecificExitCode = $value"
}

ServiceType

STRING

Type of service provided to calling processes.

Available values:

'Kernel Driver', 'File System Driver', 'Adapter', 'Recognizer Driver', 'Own Process', 'Share Process', 'Interactive Process'
# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, ServiceType

# reading property value:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, ServiceType | Foreach-Object {

  $caption = $_.Caption
  $value = $_.ServiceType
  "${caption}: ServiceType = $value"
}

Started

BOOL

Indicates whether or not the service is started.

# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, Started

# filtering all instances with Started set to $true:
Get-CimInstance -ClassName Win32_Service | Where-Object Started -eq $true | Select-Object -Property Name, Started

StartMode

STRING

Start mode of the Windows base service.

Value Description
Boot Device driver started by the operating system loader (valid only for driver services).
System Device driver started by the operating system initialization process. This value is valid only for driver services.
Auto Service to be started automatically by the service control manager during system startup. Auto services are started even if a user does not log on.
Manual Service to be started by the Service Control Manager when a process calls the StartService method. These services do not start unless a user logs on and starts them.
Disabled Service that cannot be started until its StartMode is changed to either Auto or Manual.

Available values:

'Boot', 'System', 'Auto', 'Manual', 'Disabled'
# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, StartMode

# reading property value:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, StartMode | Foreach-Object {

  $caption = $_.Caption
  $value = $_.StartMode
  "${caption}: StartMode = $value"
}

StartName

STRING

Account name under which a service runs. Depending on the service type, the account name may be in the form of “DomainName\Username” or UPN format (“Username@DomainName”). The service process is logged by using one of these two forms when it runs. If the account belongs to the built-in domain, then “.\Username” can be specified. For kernel or system-level drivers, StartName contains the driver object name (that is, “\FileSystem\Rdr” or “\Driver\Xns”) which the I/O system uses to load the device driver. Additionally, if NULL is specified, the driver runs with a default object name created by the I/O system based on the service name.

Example: “DWDOM\Admin”

# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, StartName

# reading property value:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, StartName | Foreach-Object {

  $caption = $_.Caption
  $value = $_.StartName
  "${caption}: StartName = $value"
}

State

WRITEABLE STRING

Current state of the base service.

Available values:

'Stopped', 'Start Pending', 'Stop Pending', 'Running', 'Continue Pending', 'Pause Pending', 'Paused', 'Unknown'
# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, State

# reading property value:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, State | Foreach-Object {

  $caption = $_.Caption
  $value = $_.State
  "${caption}: State = $value"
}

Status

STRING MAX 10 CHAR

Current status of an object. Various operational and nonoperational statuses can be defined.

Available values:

'Degraded','Error','Lost Comm','No Contact','NonRecover','OK','Pred Fail','Service','Starting','Stopping','Stressed','Unknown'
# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, Status

# reading property value:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, Status | Foreach-Object {

  $caption = $_.Caption
  $value = $_.Status
  "${caption}: Status = $value"
}

SystemCreationClassName

STRING

Type name of the system that hosts this service.

# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, SystemCreationClassName

# reading property value:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, SystemCreationClassName | Foreach-Object {

  $caption = $_.Caption
  $value = $_.SystemCreationClassName
  "${caption}: SystemCreationClassName = $value"
}

SystemName

STRING

Name of the system that hosts this service.

# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, SystemName

# reading property value:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, SystemName | Foreach-Object {

  $caption = $_.Caption
  $value = $_.SystemName
  "${caption}: SystemName = $value"
}

TagId

UINT32

Unique tag value for this service in the group. A value of 0 (zero) indicates that the service does not have a tag. A tag can be used to order service startup within a load order group by specifying a tag order vector in the registry located at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\GroupOrderList.

Tags are only evaluated for Kernel Driver and File System Driver start type services that have Boot or System start modes.

# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, TagId

# reading property value:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, TagId | Foreach-Object {

  $caption = $_.Caption
  $value = $_.TagId
  "${caption}: TagId = $value"
}

WaitHint

UINT32

Estimated time required, in milliseconds, for a pending start, stop, pause, or continue operation. After the specified time has elapsed, the service makes its next call to the SetServiceStatus method with either an incremented CheckPoint value or a change in CurrentState. If the amount of time specified by WaitHint passes, and CheckPoint has not been incremented, or CurrentState has not changed, the service control manager or service control program assumes that an error has occurred.

# returning class instances:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, WaitHint

# reading property value:
Get-CimInstance -ClassName Win32_Service | Select-Object -Property Name, WaitHint | Foreach-Object {

  $caption = $_.Caption
  $value = $_.WaitHint
  "${caption}: WaitHint = $value"
}

CDXML Definition

You can turn this WMI class and its methods into PowerShell cmdlets by importing below CDXML file (Cmdlet Definition XML) as a module.

Create Win32_Service.cdxml
$folder = "c:\wmi\Win32_Service"
$cdxmlPath = Join-Path -Path $folder -ChildPath "Win32_Service.cdxml"

# create folder if not present:
$exists = Test-Path -Path $folder
if (!$exists) { $null = New-Item -Path $folder -ItemType Directory }

# write file
$content = @'
<?xml version="1.0" encoding="utf-8"?>


<!--
This file is licensed under 'Attribution 4.0 International' license (https://creativecommons.org/licenses/by/4.0/).

You can free of charge use this code in commercial and non-commercial code, and you can freely modify and adjust the code 
as long as you give appropriate credit to the original author Dr. Tobias Weltner.

This material was published and is maintained here: 

https://powershell.one/wmi/root/cimv2/win32_service#cdxml-definition
-->


<PowerShellMetadata xmlns="http://schemas.microsoft.com/cmdlets-over-objects/2009/11">
  <!--referencing the WMI class this cdxml uses-->
  <Class ClassName="Root/CIMV2\Win32_Service" ClassVersion="2.0">
    <Version>1.0</Version>
    <!--default noun used by Get-cmdlets and when no other noun is specified. By convention, we use the prefix "WMI" and the base name of the WMI class involved. This way, you can easily identify the underlying WMI class.-->
    <DefaultNoun>WmiService</DefaultNoun>
    <!--define the cmdlets that work with class instances.-->
    <InstanceCmdlets>
      <!--query parameters to select instances. This is typically empty for classes that provide only one instance-->
      <GetCmdletParameters DefaultCmdletParameterSet="ByName">
        <QueryableProperties>
          <Property PropertyName="Name">
            <Type PSType="system.string" />
            <RegularQuery AllowGlobbing="false">
              <CmdletParameterMetadata Position="0" CmdletParameterSets="ByName" IsMandatory="false" />
            </RegularQuery>
          </Property>
        </QueryableProperties>
      </GetCmdletParameters>
      <GetCmdlet>
        <CmdletMetadata Verb="Get" />
        <GetCmdletParameters DefaultCmdletParameterSet="ByName">
          <QueryableProperties>
            <Property PropertyName="AcceptPause">
              <Type PSType="switch" />
              <RegularQuery AllowGlobbing="false">
                <CmdletParameterMetadata IsMandatory="false" />
              </RegularQuery>
            </Property>
            <Property PropertyName="AcceptStop">
              <Type PSType="switch" />
              <RegularQuery AllowGlobbing="false">
                <CmdletParameterMetadata IsMandatory="false" />
              </RegularQuery>
            </Property>
            <Property PropertyName="CheckPoint">
              <Type PSType="system.uint32" />
              <RegularQuery AllowGlobbing="false">
                <CmdletParameterMetadata IsMandatory="false" />
              </RegularQuery>
            </Property>
            <Property PropertyName="CreationClassName">
              <Type PSType="system.string" />
              <RegularQuery AllowGlobbing="true">
                <CmdletParameterMetadata IsMandatory="false" />
              </RegularQuery>
            </Property>
            <Property PropertyName="DelayedAutoStart">
              <Type PSType="switch" />
              <RegularQuery AllowGlobbing="false">
                <CmdletParameterMetadata IsMandatory="false" />
              </RegularQuery>
            </Property>
            <Property PropertyName="Description">
              <Type PSType="system.string" />
              <RegularQuery AllowGlobbing="true">
                <CmdletParameterMetadata IsMandatory="false" />
              </RegularQuery>
            </Property>
            <Property PropertyName="DesktopInteract">
              <Type PSType="switch" />
              <RegularQuery AllowGlobbing="false">
                <CmdletParameterMetadata IsMandatory="false" />
              </RegularQuery>
            </Property>
            <Property PropertyName="DisplayName">
              <Type PSType="system.string" />
              <RegularQuery AllowGlobbing="true">
                <CmdletParameterMetadata IsMandatory="false" />
              </RegularQuery>
            </Property>
            <Property PropertyName="ErrorControl">
              <Type PSType="system.string" />
              <RegularQuery AllowGlobbing="true">
                <CmdletParameterMetadata IsMandatory="false">
                  <ValidateSet>
                    <AllowedValue>Ignore</AllowedValue>
                    <AllowedValue>Normal</AllowedValue>
                    <AllowedValue>Severe</AllowedValue>
                    <AllowedValue>Critical</AllowedValue>
                    <AllowedValue>Unknown</AllowedValue>
                  </ValidateSet>
                </CmdletParameterMetadata>
              </RegularQuery>
            </Property>
            <Property PropertyName="ExitCode">
              <Type PSType="system.uint32" />
              <RegularQuery AllowGlobbing="false">
                <CmdletParameterMetadata IsMandatory="false" />
              </RegularQuery>
            </Property>
            <Property PropertyName="InstallDate">
              <Type PSType="system.datetime" />
              <MinValueQuery>
                <CmdletParameterMetadata PSName="BeforeInstallDate" />
              </MinValueQuery>
              <MaxValueQuery>
                <CmdletParameterMetadata PSName="AfterInstallDate" />
              </MaxValueQuery>
            </Property>
            <Property PropertyName="Name">
              <Type PSType="system.string" />
              <RegularQuery AllowGlobbing="true">
                <CmdletParameterMetadata Position="0" CmdletParameterSets="ByName" IsMandatory="false" />
              </RegularQuery>
              <ExcludeQuery AllowGlobbing="true">
                <CmdletParameterMetadata IsMandatory="false" PSName="ExcludeName" CmdletParameterSets="ByName" />
              </ExcludeQuery>
            </Property>
            <Property PropertyName="PathName">
              <Type PSType="system.string" />
              <RegularQuery AllowGlobbing="true">
                <CmdletParameterMetadata IsMandatory="false" />
              </RegularQuery>
            </Property>
            <Property PropertyName="ProcessId">
              <Type PSType="system.uint32" />
              <RegularQuery AllowGlobbing="false">
                <CmdletParameterMetadata Position="0" CmdletParameterSets="ByProcessId" IsMandatory="false" />
              </RegularQuery>
            </Property>
            <Property PropertyName="ServiceSpecificExitCode">
              <Type PSType="system.uint32" />
              <RegularQuery AllowGlobbing="false">
                <CmdletParameterMetadata IsMandatory="false" />
              </RegularQuery>
            </Property>
            <Property PropertyName="ServiceType">
              <Type PSType="system.string" />
              <RegularQuery AllowGlobbing="true">
                <CmdletParameterMetadata IsMandatory="false">
                  <ValidateSet>
                    <AllowedValue>Kernel Driver</AllowedValue>
                    <AllowedValue>File System Driver</AllowedValue>
                    <AllowedValue>Adapter</AllowedValue>
                    <AllowedValue>Recognizer Driver</AllowedValue>
                    <AllowedValue>Own Process</AllowedValue>
                    <AllowedValue>Share Process</AllowedValue>
                    <AllowedValue>Interactive Process</AllowedValue>
                  </ValidateSet>
                </CmdletParameterMetadata>
              </RegularQuery>
            </Property>
            <Property PropertyName="Started">
              <Type PSType="switch" />
              <RegularQuery AllowGlobbing="false">
                <CmdletParameterMetadata IsMandatory="false" />
              </RegularQuery>
            </Property>
            <Property PropertyName="StartMode">
              <Type PSType="system.string" />
              <RegularQuery AllowGlobbing="true">
                <CmdletParameterMetadata IsMandatory="false">
                  <ValidateSet>
                    <AllowedValue>Boot</AllowedValue>
                    <AllowedValue>System</AllowedValue>
                    <AllowedValue>Auto</AllowedValue>
                    <AllowedValue>Manual</AllowedValue>
                    <AllowedValue>Disabled</AllowedValue>
                  </ValidateSet>
                </CmdletParameterMetadata>
              </RegularQuery>
            </Property>
            <Property PropertyName="StartName">
              <Type PSType="system.string" />
              <RegularQuery AllowGlobbing="true">
                <CmdletParameterMetadata IsMandatory="false" />
              </RegularQuery>
            </Property>
            <Property PropertyName="State">
              <Type PSType="system.string" />
              <RegularQuery AllowGlobbing="true">
                <CmdletParameterMetadata IsMandatory="false">
                  <ValidateSet>
                    <AllowedValue>Stopped</AllowedValue>
                    <AllowedValue>Start Pending</AllowedValue>
                    <AllowedValue>Stop Pending</AllowedValue>
                    <AllowedValue>Running</AllowedValue>
                    <AllowedValue>Continue Pending</AllowedValue>
                    <AllowedValue>Pause Pending</AllowedValue>
                    <AllowedValue>Paused</AllowedValue>
                    <AllowedValue>Unknown</AllowedValue>
                  </ValidateSet>
                </CmdletParameterMetadata>
              </RegularQuery>
            </Property>
            <Property PropertyName="Status">
              <Type PSType="system.string" />
              <RegularQuery AllowGlobbing="true">
                <CmdletParameterMetadata IsMandatory="false" />
              </RegularQuery>
            </Property>
            <Property PropertyName="TagId">
              <Type PSType="system.uint32" />
              <RegularQuery AllowGlobbing="false">
                <CmdletParameterMetadata IsMandatory="false" />
              </RegularQuery>
            </Property>
            <Property PropertyName="WaitHint">
              <Type PSType="system.uint32" />
              <MinValueQuery>
                <CmdletParameterMetadata PSName="MinWaitHint" />
              </MinValueQuery>
              <MaxValueQuery>
                <CmdletParameterMetadata PSName="MaxWaitHint" />
              </MaxValueQuery>
            </Property>
          </QueryableProperties>
        </GetCmdletParameters>
      </GetCmdlet>
      <!--defining additional cmdlets that modifies instance properties-->
      <!--Set-Service: invoking method Change():-->
      <Cmdlet>
        <!--defining the ConfirmImpact which indicates how severe the changes are that this cmdlet performs-->
        <CmdletMetadata Verb="Set" Noun="WmiService" ConfirmImpact="High" />
        <!--defining the WMI instance method used by this cmdlet:-->
        <Method MethodName="Change">
          <ReturnValue>
            <Type PSType="system.uint32" />
            <CmdletOutputMetadata>
              <ErrorCode />
            </CmdletOutputMetadata>
          </ReturnValue>
          <!--defining the parameters of this cmdlet:-->
          <Parameters>
            <!--native parameter name is 'DesktopInteract'-->
            <Parameter ParameterName="DesktopInteract">
              <!--the underlying parameter type is boolean which corresponds to the PowerShell .NET type [bool]-->
              <Type PSType="bool" />
              <CmdletParameterMetadata Position="0" IsMandatory="false">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <!--native parameter name is 'DisplayName'-->
            <Parameter ParameterName="DisplayName">
              <!--the underlying parameter type is string which corresponds to the PowerShell .NET type [system.string]-->
              <Type PSType="system.string" />
              <CmdletParameterMetadata Position="1" IsMandatory="false">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <!--native parameter name is 'ErrorControl'-->
            <Parameter ParameterName="ErrorControl">
              <!--the underlying parameter type is uint32 which corresponds to the PowerShell .NET type [system.uint32]-->
              <Type PSType="system.uint32" />
              <CmdletParameterMetadata Position="2" IsMandatory="false">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <!--native parameter name is 'LoadOrderGroup'-->
            <Parameter ParameterName="LoadOrderGroup">
              <!--the underlying parameter type is string which corresponds to the PowerShell .NET type [system.string]-->
              <Type PSType="system.string" />
              <CmdletParameterMetadata Position="3" IsMandatory="false">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <!--native parameter name is 'LoadOrderGroupDependencies'-->
            <Parameter ParameterName="LoadOrderGroupDependencies">
              <!--the underlying parameter type is string which corresponds to the PowerShell .NET type [system.string]-->
              <Type PSType="system.string" />
              <CmdletParameterMetadata Position="4" IsMandatory="false">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <!--native parameter name is 'PathName'-->
            <Parameter ParameterName="PathName">
              <!--the underlying parameter type is string which corresponds to the PowerShell .NET type [system.string]-->
              <Type PSType="system.string" />
              <CmdletParameterMetadata Position="5" IsMandatory="false">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <!--native parameter name is 'ServiceDependencies'-->
            <Parameter ParameterName="ServiceDependencies">
              <!--the underlying parameter type is string which corresponds to the PowerShell .NET type [system.string]-->
              <Type PSType="system.string" />
              <CmdletParameterMetadata Position="6" IsMandatory="false">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <!--native parameter name is 'ServiceType'-->
            <Parameter ParameterName="ServiceType">
              <!--the underlying parameter type is uint32 which corresponds to the PowerShell .NET type [system.uint32]-->
              <Type PSType="system.uint32" />
              <CmdletParameterMetadata Position="7" IsMandatory="false">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <!--native parameter name is 'StartMode'-->
            <Parameter ParameterName="StartMode">
              <!--the underlying parameter type is string which corresponds to the PowerShell .NET type [system.string]-->
              <Type PSType="system.string" />
              <CmdletParameterMetadata Position="8" IsMandatory="false">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <!--native parameter name is 'StartName'-->
            <Parameter ParameterName="StartName">
              <!--the underlying parameter type is string which corresponds to the PowerShell .NET type [system.string]-->
              <Type PSType="system.string" />
              <CmdletParameterMetadata Position="9" IsMandatory="false">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
            <!--native parameter name is 'StartPassword'-->
            <Parameter ParameterName="StartPassword">
              <!--the underlying parameter type is string which corresponds to the PowerShell .NET type [system.string]-->
              <Type PSType="system.string" />
              <CmdletParameterMetadata Position="10" IsMandatory="false">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
          </Parameters>
        </Method>
      </Cmdlet>
      <!--Set-ServiceStartMode: invoking method ChangeStartMode():-->
      <Cmdlet>
        <!--defining the ConfirmImpact which indicates how severe the changes are that this cmdlet performs-->
        <CmdletMetadata Verb="Set" Noun="WmiServiceStartMode" ConfirmImpact="High" />
        <!--defining the WMI instance method used by this cmdlet:-->
        <Method MethodName="ChangeStartMode">
          <ReturnValue>
            <Type PSType="system.uint32" />
            <CmdletOutputMetadata>
              <ErrorCode />
            </CmdletOutputMetadata>
          </ReturnValue>
          <!--defining the parameters of this cmdlet:-->
          <Parameters>
            <!--native parameter name is 'StartMode'-->
            <Parameter ParameterName="StartMode">
              <!--the underlying parameter type is string which corresponds to the PowerShell .NET type [system.string]-->
              <Type PSType="system.string" />
              <CmdletParameterMetadata Position="0" IsMandatory="false">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
          </Parameters>
        </Method>
      </Cmdlet>
      <!--Remove-Service: invoking method Delete():-->
      <Cmdlet>
        <!--defining the ConfirmImpact which indicates how severe the changes are that this cmdlet performs-->
        <CmdletMetadata Verb="Remove" Noun="WmiService" ConfirmImpact="High" />
        <!--defining the WMI instance method used by this cmdlet:-->
        <Method MethodName="Delete">
          <ReturnValue>
            <Type PSType="system.uint32" />
            <CmdletOutputMetadata>
              <ErrorCode />
            </CmdletOutputMetadata>
          </ReturnValue>
        </Method>
      </Cmdlet>
      <!--Get-ServiceSecurityDescriptor: invoking method GetSecurityDescriptor():-->
      <Cmdlet>
        <!--defining the ConfirmImpact which indicates how severe the changes are that this cmdlet performs-->
        <CmdletMetadata Verb="Get" Noun="WmiServiceSecurityDescriptor" ConfirmImpact="Low" />
        <!--defining the WMI instance method used by this cmdlet:-->
        <Method MethodName="GetSecurityDescriptor">
          <ReturnValue>
            <Type PSType="system.uint32" />
            <CmdletOutputMetadata>
              <ErrorCode />
            </CmdletOutputMetadata>
          </ReturnValue>
          <!--defining the parameters of this cmdlet:-->
          <Parameters>
            <!--Method returns an instance of Win32_SecurityDescriptor in property Descriptor-->
            <Parameter ParameterName="Descriptor">
              <Type PSType="Microsoft.Management.Infrastructure.CimInstance[]" />
              <CmdletOutputMetadata />
            </Parameter>
          </Parameters>
        </Method>
      </Cmdlet>
      <!--Get-ServiceState: invoking method InterrogateService():-->
      <Cmdlet>
        <!--defining the ConfirmImpact which indicates how severe the changes are that this cmdlet performs-->
        <CmdletMetadata Verb="Get" Noun="WmiServiceState" ConfirmImpact="Medium" />
        <!--defining the WMI instance method used by this cmdlet:-->
        <Method MethodName="InterrogateService">
          <ReturnValue>
            <Type PSType="system.uint32" />
            <CmdletOutputMetadata>
              <ErrorCode />
            </CmdletOutputMetadata>
          </ReturnValue>
        </Method>
      </Cmdlet>
      <!--Suspend-Service: invoking method PauseService():-->
      <Cmdlet>
        <!--defining the ConfirmImpact which indicates how severe the changes are that this cmdlet performs-->
        <CmdletMetadata Verb="Suspend" Noun="WmiService" ConfirmImpact="Medium" />
        <!--defining the WMI instance method used by this cmdlet:-->
        <Method MethodName="PauseService">
          <ReturnValue>
            <Type PSType="system.uint32" />
            <CmdletOutputMetadata>
              <ErrorCode />
            </CmdletOutputMetadata>
          </ReturnValue>
        </Method>
      </Cmdlet>
      <!--Resume-Service: invoking method ResumeService():-->
      <Cmdlet>
        <!--defining the ConfirmImpact which indicates how severe the changes are that this cmdlet performs-->
        <CmdletMetadata Verb="Resume" Noun="WmiService" ConfirmImpact="Medium" />
        <!--defining the WMI instance method used by this cmdlet:-->
        <Method MethodName="ResumeService">
          <ReturnValue>
            <Type PSType="system.uint32" />
            <CmdletOutputMetadata>
              <ErrorCode />
            </CmdletOutputMetadata>
          </ReturnValue>
        </Method>
      </Cmdlet>
      <!--Set-ServiceSecurityDescriptor: invoking method SetSecurityDescriptor():-->
      <Cmdlet>
        <!--defining the ConfirmImpact which indicates how severe the changes are that this cmdlet performs-->
        <CmdletMetadata Verb="Set" Noun="WmiServiceSecurityDescriptor" ConfirmImpact="High" />
        <!--defining the WMI instance method used by this cmdlet:-->
        <Method MethodName="SetSecurityDescriptor">
          <ReturnValue>
            <Type PSType="system.uint32" />
            <CmdletOutputMetadata>
              <ErrorCode />
            </CmdletOutputMetadata>
          </ReturnValue>
          <!--defining the parameters of this cmdlet:-->
          <Parameters>
            <!--native parameter name is 'Descriptor'-->
            <Parameter ParameterName="Descriptor">
              <!--the underlying parameter type is Win32_SecurityDescriptor which corresponds to the PowerShell .NET type [System.Management.ManagementBaseObject]-->
              <Type PSType="System.Management.ManagementBaseObject" />
              <CmdletParameterMetadata Position="0" IsMandatory="false">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
          </Parameters>
        </Method>
      </Cmdlet>
      <!--Start-Service: invoking method StartService():-->
      <Cmdlet>
        <!--defining the ConfirmImpact which indicates how severe the changes are that this cmdlet performs-->
        <CmdletMetadata Verb="Start" Noun="WmiService" ConfirmImpact="Low" />
        <!--defining the WMI instance method used by this cmdlet:-->
        <Method MethodName="StartService">
          <ReturnValue>
            <Type PSType="system.uint32" />
            <CmdletOutputMetadata>
              <ErrorCode />
            </CmdletOutputMetadata>
          </ReturnValue>
        </Method>
      </Cmdlet>
      <!--Stop-Service: invoking method StopService():-->
      <Cmdlet>
        <!--defining the ConfirmImpact which indicates how severe the changes are that this cmdlet performs-->
        <CmdletMetadata Verb="Stop" Noun="WmiService" ConfirmImpact="Medium" />
        <!--defining the WMI instance method used by this cmdlet:-->
        <Method MethodName="StopService">
          <ReturnValue>
            <Type PSType="system.uint32" />
            <CmdletOutputMetadata>
              <ErrorCode />
            </CmdletOutputMetadata>
          </ReturnValue>
        </Method>
      </Cmdlet>
      <!--Set-ServiceControlCode: invoking method UserControlService():-->
      <Cmdlet>
        <!--defining the ConfirmImpact which indicates how severe the changes are that this cmdlet performs-->
        <CmdletMetadata Verb="Set" Noun="WmiServiceControlCode" ConfirmImpact="Medium" />
        <!--defining the WMI instance method used by this cmdlet:-->
        <Method MethodName="UserControlService">
          <ReturnValue>
            <Type PSType="system.uint32" />
            <CmdletOutputMetadata>
              <ErrorCode />
            </CmdletOutputMetadata>
          </ReturnValue>
          <!--defining the parameters of this cmdlet:-->
          <Parameters>
            <!--native parameter name is 'ControlCode'-->
            <Parameter ParameterName="ControlCode">
              <!--the underlying parameter type is uint8 which corresponds to the PowerShell .NET type [byte]-->
              <Type PSType="byte" />
              <CmdletParameterMetadata Position="0" IsMandatory="false">
                <ValidateNotNull />
                <ValidateNotNullOrEmpty />
              </CmdletParameterMetadata>
            </Parameter>
          </Parameters>
        </Method>
      </Cmdlet>
    </InstanceCmdlets>
  </Class>
</PowerShellMetadata>
'@ | Set-Content -LiteralPath $cdxmlPath -Encoding UTF8

# import module
Import-Module -Name $cdxmlPath -Force -Verbose

# list new cmdlets
Get-Command -Module "Win32_Service"

See Also

Associated Classes:

Win32_ComputerSystem

Win32_ServiceSpecification

Requirements

To use Win32_Service, the following requirements apply:

PowerShell

Get-CimInstance was introduced with PowerShell Version 3.0, which in turn was introduced on clients with Windows 8 and on servers with Windows Server 2012.

If necessary, update Windows PowerShell to Windows PowerShell 5.1, or install PowerShell 7 side-by-side.

Operating System

Win32_Service was introduced on clients with Windows Vista and on servers with Windows Server 2008.

Namespace

Win32_Service lives in the namespace root/cimv2. This is the default namespace. There is no need to use the -Namespace parameter in Get-CimInstance.

Implementation

Win32_Service is implemented in CIMWin32.dll and defined in CIMWin32.mof. Both files are located in the folder C:\Windows\system32\wbem:

explorer $env:windir\system32\wbem
notepad $env:windir\system32\wbem\CIMWin32.mof