Windows Server 2008 : Manipulating Services with wmic

You can also manipulate services with the Windows Management Instrumentation command-line (wmic) tool.

Note

WMI is used to query and configure local and remote systems for a wide variety of purposes. wmic is the command-line tool used to execute many WMI commands. This section covers only the use of WMIC for services, but wmic can be used for much more.

wmic is a shell command. You can type wmic from the command prompt and press Enter to enter the wmic shell. The wmic shell prompt starts in the root\cli name space, and you can then enter commands from there. For example, to get a listing of all services on a local computer, you can use the service command after entering the shell like the following:

C:\>wmic
wmic:root\cli>service

You can also enter the full wmic command from the command prompt by preceding it with wmic. For example, the following command provides the same output as the previous command:

C:\>wmic service

If you want to get information on a remote system, add the /node:computer -name switch to the wmic command like the following:

C:\>wmic /node:dc1 service

If the remote system’s firewall doesn’t allow WMI commands, the command will fail. You need to configure the firewall to allow wmic commands first, as shown in the following section.

Configuring the Firewall to Allow wmic

If you want to run wmic commands on remote computers, you need to ensure the firewall is configured to allow the remote connections. The primary error you see that indicates that WMI commands are prevented by the firewall is “The RPC server is unavailable.”

Tip

You see the error “The RPC server is unavailable” if the remote system is unreachable. You can try the ping command to determine whether the remote system is operational and verify you’re using the correct host name. If ping works but wmic is not working, check the firewall.

You can configure the firewall to allow wmic commands by allowing the Windows Management Instrumentation (WMI) program through the firewall. Figure 1 shows the Windows Firewall Settings screen on a Windows Server 2008 system. You can get to this screen by starting the Control Panel, entering Firewall in the Search Control Panel text box, and selecting Allow a Program through Windows Firewall. Ensure that the checkbox for Windows Management Instrumentation (WMI) is checked.

Figure 1. Enabling WMI in the firewall

Using the wmic service list Command

wmic includes the service command, which you can use to query and manipulate services. The most basic wmic service command is

wmic service list

The following table shows some switches you can use with the wmic service list command. Each of these commands can be entered on the local computer by omitting the /node:computer -name switch, or on a remote computer by using the /node:computer-name switch.

wmic service list Options	Comments
Full in table format: C:\>wmic service list C:\>wmic /node:dc1 service list	Includes all the properties in a table format. The examples execute the command on the local computer and on a remote computer named DC1.
Full in list format: C:\>wmic service list full C:\>wmic /node:dc1 service list full	Includes all the properties in a list format.
Brief listing: C:\>wmic service list brief C:\>wmic /node:dc1 service list brief	Includes only the following properties: ExitCode, Name, ProcessId, StartMode, State, and Status.
Control: C:\>wmic service list control C:\>wmic /node:dc1 service list control	Includes only the following properties: AcceptPause, AcceptStop, ErrorControl, Name, StartMode, and StartName.
Instance: C:\>wmic service list instance C:\>wmic /node:dc1 service list instance	Includes only the Name property.
Status: C:\>wmic service list status C:\>wmic/node:dc1 service list status	Includes the Name, Status, and ExitCode properties.

Using the wmic service call Command

The other valuable command you can use with wmic service is the call command, which enables you to manipulate services. The wmic service call commands use a where clause to identify the service that will be manipulated by the call command. The where clause has the following format:

where caption="display-name"

More specifically, if you want to stop a service, use the following format:

wmic service where caption="display-name" call stopservice

For example, if you want to stop the FTP Publishing Service, you can use the following command:

wmic service where caption="ftp publishing service" call stopservice

Note that the net and sc commands use the service name, while the where clause of the wmic service call command uses the display-name. You can compare these names in Figure 2, which shows both the Service Name and the Display Name for the FTP Publishing Service.

Figure 2. The FTP Publishing Service properties from the Services console

If you want to stop the FTP Publishing Service, use any of the following commands.

Stopping the FTP Publishing Service	Comments
C:\>net stop msftpsvc	Stops the service with the net command.
C:\>sc stop msftpsvc	Stops the service with the sc command.
C:\>wmic service where caption="ftp publishing service" call stopservice	Stops the service with wmic.

The following table shows other uses of the call command with wmic service.

wmic service call Command	Comments
Modify the start mode of the service. wmic service where caption="display- name" call changestartmode disabled | manual | automatic C:\>wmic service where caption="ftp publishing service" call changestartmode disabled	You can set a service to start automatically, manually, or as disabled by using the changestartmode command. This refers to the Startup Type of the service. Figure 2 shows the Startup Type of the FTP Publishing Service as Manual. The example changes the service to disabled.
Stop or start a service. wmic service where caption="display- name " call stopservice | startservice C:\>wmic service where caption="ftp publishing service" call startservice C:\>wmic service where caption="ftp publishing service" call stopservice	The call stopservice and call startservice commands stop and start a service, respectively.
Pause or resume a service. wmic service where caption="display- name " call pauseservice | resumeservice C:\>wmic service where caption="ftp publishing service" call pauseservice C:\>wmic service where caption="ftp publishing service" call resumeservice	The call pauseservice and call resumeservice commands pause and resume a service, respectively.

Tip

Any of the commands in the preceding table can be executed on a remote system by adding the /node:computer -name switch immediately after wmic. For example, to change the mode to disabled on a remote computer named dc1, the following command is used:

wmic /node:dc1 service where caption="ftp publishing service" call
changestartmode disabled

Tip

You can also do fuzzy queries with the like operator and the percent (%)wildcard if you don’t know the exact name. For example: wmic service where (name like w%) shows all services that start with “w”.