如何使用 Powershell 查找、停止和禁用 Windows 服务

Question

I am trying to find a service, stop it and then disable it remotely using Powershell. It can find and stop but cannot disable. For disabling, I have to run the Set-Service command separately. Can it be done in one line?

The following code-snippet will stop the Print Spooler service, but will not disable it:

$ip = "10.10.10.10"
$svc_name = "Spooler"
get-service -ComputerName $ip | Where-Object {$_.Name -eq $svc_name} |  Stop-Service | Set-Service -StartupType  Disabled

The following code-snippet will stop and disable the Print Spooler service:

$ip = "10.10.10.10"
$svc_name = "Spooler"
get-service -ComputerName $ip | Where-Object {$_.Name -eq $svc_name} |  Stop-Service
Set-Service $svc_name -StartupType  Disabled

Powershell version is 5.1.14393.2969 .

Edit: The following line will also find and disable. So, it looks like I can give two instructions with pipeline.

get-service -ComputerName $ip | Where-Object {$_.Name -eq $svc_name} | Set-Service -StartupType  Disabled

Answer 1

You need to use Set-Service to set the startup type, as outlined in your question:

Set-Service -StartupType Disabled $svc_name

If you want to do it in "one line", you can use the -PassThru argument on Stop-Service to return the service object which can then be sent down the pipeline (you also don't need a Where-Object clause, Get-Service can filter on service name as well):

Get-Service -ComputerName $ip $svc_name | Stop-Service -PassThru | Set-Service -StartupType Disabled

You had this close in your original question, but it didn't work because you didn't use the -PassThru parameter on Stop-Service . As a note, many cmdlets that don't return an object by default do include a -PassThru parameter to return an object that can further processed if necessary, this isn't limited to Stop-Service by any means.

Answer 2

#I'm going to just put this here because I learned a VALUABLE lesson about results queries doing this:

Stopping both Windows Firewall and Windows Defender Firewall

$date = get-date -uformat "%m%d%y-%H"
$day =  Get-Date -Format yyyyMMdd
$dayold = Get-Date -Format "%M%d%y"
$today = (Get-Date -Format yyyyMMdd)+"-"+(get-date -uformat %H) #<--
#$log = ".\Logs\$today-Automation-WindowsFirewall.log"
$ErrorActionPreference = "SilentlyContinue"
#Stop-Transcript | Out-Null
#$ErrorActionPreference = "Continue"
#Start-Transcript -Path $log -Append
#$ServerListFile = ".\input\list.txt"
$ServerList = (Get-adcomputer -SearchBase "OU=site,OU=servers,DC=subdomain,DC=domain,DC=root" -filter {name -like "*cont*ext*"} -SearchScope Subtree -Properties Name) |select name
#$ServerList = Get-Content $ServerListFile
$ServerList=$ServerList.name
(Test-Connection -ComputerName $env:LOGONSERVER.Remove(0,2) -Count 1 -quiet)|Out-Null
foreach ($server in $ServerList){
#$server = "testserverfromlist" #<-- use to manually test script from here
if(Test-Connection -ComputerName $server -Count 1 -quiet){
$result = (get-service -ComputerName $server -name MpsSvc |select *)
if($result.Status -eq "Running")
    {
    get-service -ComputerName $server -name MpsSvc |stop-service -Force
    #get-service -ComputerName $server -name MpsSvc |stop-service -ErrorAction Inquire
    get-service -ComputerName $server -name MpsSvc |set-service -ComputerName $server -StartupType Disabled
    }
    elseif($result.StartType -ne "Disabled"){
    set-service -ComputerName $server -name MpsSvc -StartupType "Disabled"
    }
        $result = (get-service -ComputerName $server -name MpsSvc |select *)
        $server+": "+"The "+$result.DisplayName+" is "+$result.Status+" and "+$result.StartType
    }
    }

HOORAH!

Answer 3

Bender's answer works in PowerShell 5.1, but the -ComputerName parameter was removed from the Get-Service cmdlet in PowerShell 6+. If you're trying to do this in pwsh.exe (ie PowerShell 6+), you can use code like the following:

[string[]] $servers = @('server1', 'server2, 'server3')

[scriptblock] $disableServiceScriptBlock = {
    [string] $serviceName = 'SERVICE NAME TO DISABLE GOES HERE'
    Stop-Service -Name $serviceName
    Set-Service -Name $serviceName -StartupType Disabled
}

Invoke-Command -ComputerName $servers -ScriptBlock $disableServiceScriptBlock

Here's a longer code snippet with better error reporting so you know what server an error occurred on:

[string[]] $servers = @('server1', 'server2, 'server3')

[scriptblock] $disableServiceScriptBlock = {
    [string] $serviceName = 'SERVICE NAME TO DISABLE GOES HERE'
    Stop-Service -Name $serviceName -ErrorVariable stopError -ErrorAction SilentlyContinue
    Set-Service -Name $serviceName -StartupType Disabled -ErrorVariable disableError -ErrorAction SilentlyContinue

    # If an error occurred, report which server it occurred on with the error message.
    [string] $computerName = $Env:ComputerName
    if ($stopError)
    {
        Write-Error "$computerName : Stop Error: $stopError"
    }
    if ($disableError)
    {
        Write-Error "$computerName : Disable Error: $disableError"
    }
}

Invoke-Command -ComputerName $servers -ScriptBlock $disableServiceScriptBlock