Win32_BaseService - powershell.one

The Win32_BaseService abstract WMI class represents executable objects that are installed in a registry database maintained by the Service Control Manager. The executable file associated with a service can be started at boot time by a boot program or by the system. It can also be started on-demand by the Service Control Manager. Any service or process that is not owned by a specific user, and that provides an interface to some functionality supported by the computer system, is a descendant (or member) of this class. Example: The dynamic host configuration protocol (DHCP) client service on a computer system running Windows Server.

Methods

Win32_BaseService has 10 methods:

Method	Description
Change	Modifies a service.
ChangeStartMode	Modifies the start mode of a service.
Create	Creates a new service.
Delete	Deletes an existing service.
InterrogateService	Requests that the service update its state to the service manager.
PauseService	Attempts to place the service in the paused state.
ResumeService	Attempts to place the service in the resumed state.
StartService	Attempts to place the service into its startup state.
StopService	Class method that places the service in the stopped state.
UserControlService	Attempts to send a user-defined control code to a service.

Learn more about Invoke-CimMethod and how to invoke commands. Click any of the methods listed above to learn more about their purpose, parameters, and return value.

Properties

Win32_BaseService returns 18 properties:

'AcceptPause','AcceptStop','Caption','CreationClassName','Description',
'DesktopInteract','DisplayName','ErrorControl','ExitCode','InstallDate','Name','PathName',
'ServiceSpecificExitCode','ServiceType','Started','StartMode','StartName','State'

Unless explicitly marked as writeable, all properties are read-only. Read all properties for all instances:

Get-CimInstance -ClassName Win32_BaseService -Property *

Most WMI classes return one or more instances.

When Get-CimInstance returns no result, then apparently no instances of class Win32_BaseService exist. This is normal behavior.

Either the class is not implemented on your system (may be deprecated or due to missing drivers, i.e. CIM_VideoControllerResolution), or there are simply no physical representations of this class currently available (i.e. Win32_TapeDrive).

AcceptPause

BOOLEAN

Service can be paused.

Get-CimInstance -ClassName Win32_BaseService | Select-Object -Property Name, AcceptPause

AcceptStop

BOOLEAN

Service can be stopped.

Get-CimInstance -ClassName Win32_BaseService | Select-Object -Property Name, AcceptStop

Caption

STRING MAX 64 CHAR

Short description of the object.

Get-CimInstance -ClassName Win32_BaseService | Select-Object -Property Name, Caption

CreationClassName

STRING

Name of the first concrete class to appear in the inheritance chain used in the creation of an instance. When used with the other key properties of the class, the property allows all instances of this class and its subclasses to be uniquely identified.

Get-CimInstance -ClassName Win32_BaseService | Select-Object -Property Name, CreationClassName

Description

STRING

Description of the object.

Get-CimInstance -ClassName Win32_BaseService | Select-Object -Property Name, Description

DesktopInteract

BOOLEAN

Service can create or communicate with windows on the desktop.

Get-CimInstance -ClassName Win32_BaseService | Select-Object -Property Name, DesktopInteract

DisplayName

STRING

Display name of the service. This string has a maximum length of 256 characters. The name is case-preserved in the Service Control Manager. Comparisons of DisplayName are always case-insensitive.

Constraints: Accepts the same value as the Name property.

Example: “Atdisk”

Get-CimInstance -ClassName Win32_BaseService | Select-Object -Property Name, DisplayName

ErrorControl

STRING

Severity of the error. Service fails to start. The value indicates the action taken by the startup program if failure occurs. All errors are logged by the computer system.

User is not notified.

User is notified.

System restarted with the last-known-good configuration.

System attempts to restart with a good configuration.

Action taken is unspecified.

Get-CimInstance -ClassName Win32_BaseService | Select-Object -Property Name, ErrorControl

ExitCode

UINT32

Defining any problems encountered in starting or stopping the service. This property is set to ERROR_SERVICE_SPECIFIC_ERROR (1066) when the error is unique to the service represented by this class, and information about the error is available in the ServiceSpecificExitCode property. The service sets this value to NO_ERROR when running, and again upon normal termination.

Get-CimInstance -ClassName Win32_BaseService | Select-Object -Property Name, ExitCode

InstallDate

DATETIME

Object was installed. This property does not need a value to indicate that the object is installed.

Get-CimInstance -ClassName Win32_BaseService | Select-Object -Property Name, InstallDate

Name

KEY PROPERTY STRING

Unique identifier of the service, which provides an indication of the functionality that is managed. This functionality is described in more detail in the object’s Description property.

Get-CimInstance -ClassName Win32_BaseService | Select-Object -Property Name

PathName

STRING

Fully qualified path to the service binary file that implements the service.

Example: “\SystemRoot\System32\drivers\afd.sys”

Get-CimInstance -ClassName Win32_BaseService | Select-Object -Property Name, PathName

ServiceSpecificExitCode

UINT32

Service-specific error code for errors that occur while the service is either starting or stopping. The exit codes are defined by the service represented by this class. This value is only set when the ExitCodeproperty value is ERROR_SERVICE_SPECIFIC_ERROR (1066).

Get-CimInstance -ClassName Win32_BaseService | Select-Object -Property Name, ServiceSpecificExitCode

ServiceType

STRING

Service provided to calling processes.

Kernel Driver (“Kernel Driver”)

File System Driver (“File System Driver”)

Adapter (“Adapter”)

Recognizer Driver (“Recognizer Driver”)

Own Process (“Own Process”)

Share Process (“Share Process”)

Interactive Process (“Interactive Process”)

Get-CimInstance -ClassName Win32_BaseService | Select-Object -Property Name, ServiceType

Started

BOOLEAN

Service has been started.

Get-CimInstance -ClassName Win32_BaseService | Select-Object -Property Name, Started

StartMode

STRING

Start mode of the Windows base service.

Device driver started by the operating system loader (valid only for driver services).

Device driver started by the operating system initialization process. This value is valid only for driver services.

Service to be started automatically by the service control manager during system start up.

Service to be started by the service control manager when a process calls the StartService method.

Service that can no longer be started.

Get-CimInstance -ClassName Win32_BaseService | Select-Object -Property Name, StartMode

StartName

STRING

Account name under which the service runs. Depending on the service type, the account name may be in the form of “DomainName\Username” or UPN format (Username@DomainName). The service process will be logged using one of these two forms when it runs. If the account belongs to the built-in domain, “.\Username” can be specified. If NULL is specified, the service will be logged on as the LocalSystem account. For kernel or system-level drivers, StartName contains the driver object name (that is, \FileSystem\Rdr or \Driver\Xns) which the input and output (I/O) system uses to load the device driver. Additionally, if NULL is specified, the driver runs with a default object name created by the I/O system based on the service name. Example: “DWDOM\Admin”.

Get-CimInstance -ClassName Win32_BaseService | Select-Object -Property Name, StartName

State

WRITEABLE STRING

Current state of the base service.

Stopped (“Stopped”)

Start Pending (“Start Pending”)

Stop Pending (“Stop Pending”)

Running (“Running”)

Continue Pending (“Continue Pending”)

Pause Pending (“Pause Pending”)

Paused (“Paused”)

Unknown (“Unknown”)

Get-CimInstance -ClassName Win32_BaseService | Select-Object -Property Name, State

Examples

List all instances of Win32_BaseService

Get-CimInstance -ClassName Win32_BaseService

Learn more about Get-CimInstance and the deprecated Get-WmiObject.

View all properties

Get-CimInstance -ClassName Win32_BaseService -Property *

View key properties only

Get-CimInstance -ClassName Win32_BaseService -KeyOnly

Selecting Properties

To select only some properties, pipe the results to Select-Object -Property a,b,c with a comma-separated list of the properties you require. Wildcards are permitted.

Get-CimInstance always returns all properties but only retrieves the ones that you specify. All other properties are empty but still present. That’s why you need to pipe the results into Select-Object if you want to limit the visible properties, i.e. for reporting.

Selecting Properties

The code below lists all available properties. Remove the ones you do not need:

$properties = 'AcceptPause',
              'AcceptStop',
              'Caption',
              'CreationClassName',
              'Description',
              'DesktopInteract',
              'DisplayName',
              'ErrorControl',
              'ExitCode',
              'InstallDate',
              'Name',
              'PathName',
              'ServiceSpecificExitCode',
              'ServiceType',
              'Started',
              'StartMode',
              'StartName',
              'State'
Get-CimInstance -ClassName Win32_BaseService | Select-Object -Property $properties

Limiting Network Bandwidth

If you work remotely, it makes sense to limit network bandwidth by filtering the properties on the server side, too:

Get-CimInstance -Class Win32_BaseService -Property $property | 
Select-Object -Property $property

Selecting Instances

To select some instances, use Get-CimInstance and a WMI Query. The wildcard character in WMI Queries is % (and not “*”).

The parameter -Filter runs a simple query.

Listing all instances where the property Caption starts with “A”

Get-CimInstance -Class Win32_BaseService -Filter 'Caption LIKE "a%"' 

Using a WQL Query

The parameter -Query uses a query similar to SQL and combines the parameters -Filter and -Property. This returns all instances where the property Caption starts with “A”, and returns the properties specified:

Get-CimInstance -Query "SELECT InstallDate, ServiceSpecificExitCode, StartMode, State FROM Win32_BaseService WHERE Caption LIKE 'a%'"

Any property you did not specify is still present but empty. You might need to use Select-Object to remove all unwanted properties:
Get-CimInstance -Query "SELECT InstallDate, ServiceSpecificExitCode, StartMode, State FROM Win32_BaseService WHERE Caption LIKE 'a%'" | Select-Object -Property InstallDate, ServiceSpecificExitCode, StartMode, State

Accessing Remote Computers

To access remote systems, you need to have proper permissions. User the parameter -ComputerName to access one or more remote systems.

Authenticating as Current User

# one or more computer names or IP addresses:
$list = 'server1', 'server2'

# authenticate with your current identity:
$result = Get-CimInstance -ClassName Win32_BaseService -ComputerName $list 
$result

Authenticating as Different User

Use a CIMSession object to authenticate with a new identity:

# one or more computer names or IP addresses:
$list = 'server1', 'server2'

# authenticate with a different identity:
$cred = Get-Credential -Message 'Authenticate to retrieve WMI information:'
$session = New-CimSession -ComputerName $list -Credential $cred

$result = Get-CimInstance Win32_BaseService -CimSession $session

# remove the session after use (if you do not plan to re-use it later)
Remove-CimSession -CimSession $session

$result

Learn more about accessing remote computers.

Requirements

To use Win32_BaseService, the following requirements apply:

PowerShell

Get-CimInstance was introduced with PowerShell Version 3.0, which in turn was introduced on clients with Windows 8 and on servers with Windows Server 2012.

If necessary, update Windows PowerShell to Windows PowerShell 5.1, or install PowerShell 7 side-by-side.

Operating System

Win32_BaseService was introduced on clients with Windows Vista and on servers with Windows Server 2008.

Namespace

Win32_BaseService lives in the Namespace Root/CIMV2. This is the default namespace. There is no need to use the -Namespace parameter in Get-CimInstance.

Implementation

Win32_BaseService is implemented in CIMWin32.dll and defined in CIMWin32.mof. Both files are located in the folder C:\Windows\system32\wbem:

explorer $env:windir\system32\wbem
notepad $env:windir\system32\wbem\CIMWin32.mof

PREVIOUSArchive