{"id":17241,"date":"2010-09-02T00:01:00","date_gmt":"2010-09-02T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2010\/09\/02\/using-windows-powershell-to-determine-service-launch-order\/"},"modified":"2010-09-02T00:01:00","modified_gmt":"2010-09-02T00:01:00","slug":"using-windows-powershell-to-determine-service-launch-order","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/using-windows-powershell-to-determine-service-launch-order\/","title":{"rendered":"Using Windows PowerShell to Determine Service Launch Order"},"content":{"rendered":"

<\/strong><\/p>\n

Summary<\/strong>: The Microsoft Scripting Guys show how to determine service launch order by using Windows PowerShell and WMI in this helpful step-by-step article.<\/p>\n

 <\/p>\n

\"Hey, Hey, Scripting Guy! I need to find out the order in which services start on my computer. To properly shut down a computer, the services should stop in reverse order that they start. I can find service dependencies via the services.msc tool, but I cannot seem to find anywhere that tells me the actual order in which services start. Can you help me?<\/p>\n

— RY<\/p>\n

\"Hey,<\/p>\n

Hello RY, <\/p>\n

Microsoft Scripting Guy Ed Wilson here. I was deep in thought working on a script to illustrate service load order when the landline<\/a> rang. My landline almost never rings, and if it does, it is generally phone spam<\/a>, which I ignore it. In fact, I do not even bother to look at the caller ID<\/a> because I know the call will not be of interest to me. If people want to talk to me, they call my Windows Mobile 6.5 phone, catch me on Twitter<\/a>, post something on Facebook, shoot me an email, or find me on Communicator. They do not call my landline. For me, the only reason I have a landline is so I can have ADSL<\/a>. Now, Teresa, that is a different story. <\/p>\n

Anyway, the call was from one of the organizers of the Raleigh, NC., SQL Saturday event<\/a>, and I will now be speaking there on September 18, 2010. I am excited about the event, not only because I get to speak, but also because there will be some awesome sessions<\/a>. And all the cool people within the tri-state region will be there. I will be talking about Windows PowerShell 2.0<\/a> best practices, and I will pull together information from the Microsoft Press book, Windows PowerShell 2.0 Best Practices<\/a>, which I wrote. It will be very cool. By the way, Teresa will be there as well, and she is a lot more fun to talk to than I am. (Scripting Editor<\/strong>: They are both fun to talk to. Be sure to ask Ed about tea.)<\/p>\n

RY, once I got off the phone, I completed the Get-ServiceLoadOrder.ps1 script. The complete script is shown here. <\/p>\n

\n

Get-ServiceLoadOrder.ps1<\/strong><\/p>\n

Get-WmiObject -Class win32_LoadOrderGroupServiceMembers |
ForEach-Object {
New-Object -TypeName psobject -Property `
   @{
     “GroupOrder”=([wmi]$_.GroupComponent).GroupOrder
     “GroupName”=([wmi]$_.GroupComponent).Name
     “ServiceName”=([wmi]$_.PartComponent).Name
     “Started”=([wmi]$_.PartComponent).Started
    }
} |
Where-Object { $_.started } |
Sort-Object -Property grouporder -Descending<\/p>\n<\/blockquote>\n

Services group load order is stored in the registry in the HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\ServiceGroupOrder<\/strong> registry key. This is shown in the following image.<\/p>\n

\"Image<\/a><\/p>\n

You do not have to directly query the registry key if you do not wish to do so, because WMI can retrieve the information by querying the win32_loadOrderGroup<\/strong> WMI class. Output from this class is shown in the following image.<\/p>\n

\"Image<\/a><\/p>\n

The Get-ServiceLoadOrder.ps1 script begins by using the Get-WmiObject<\/strong> cmdlet to query the Win32_LoadOrderGroupServiceMembers<\/strong> WMI class, which is an association class. Association classes relate one WMI class to another WMI class. The two classes that are related are the Win32_BaseService<\/strong> and the Win32_LoadOrderGroup<\/strong> class. This relationship is shown in the following image.<\/p>\n

\"Image<\/a><\/p>\n

When the Win32_LoadOrderGroupServiceMembers<\/strong> WMI class is queried, the information that is returned does not look too exciting. An example of the kind of information that is returned is shown here: <\/p>\n

\n

PS C:\\> Get-WmiObject -Class win32_LoadOrderGroupServiceMembers
__GENUS                  : 2
__CLASS                   : Win32_LoadOrderGroupServiceMembers
__SUPERCLASS         : CIM_Component
__DYNASTY                : CIM_Component
__RELPATH                : Win32_LoadOrderGroupServiceMembers.GroupComponent=”\\\\\\\\MRED1\\\\roo
                                    t\\\\cimv2:Win32_LoadOrderGroup.Name=\\”Boot Bus Extender\\””,PartCom
                                    ponent=”\\\\\\\\MRED1\\\\root\\\\cimv2:Win32_SystemDriver.Name=\\”ACPI\\””
__PROPERTY_COUNT : 2
__DERIVATION           : {CIM_Component}
__SERVER                  : MRED1
__NAMESPACE           : root\\cimv2
__PATH                      : \\\\MRED1\\root\\cimv2:Win32_LoadOrderGroupServiceMembers.GroupCompon
                                     ent=”\\\\\\\\MRED1\\\\root\\\\cimv2:Win32_LoadOrderGroup.Name=\\”Boot Bus
                                     Extender\\””,PartComponent=”\\\\\\\\MRED1\\\\root\\\\cimv2:Win32_SystemDri
                                     ver.Name=\\”ACPI\\””
GroupComponent       : \\\\MRED1\\root\\cimv2:Win32_LoadOrderGroup.Name=”Boot Bus Extender”
PartComponent          : \\\\MRED1\\root\\cimv2:Win32_SystemDriver.Name=”ACPI”<\/p>\n<\/blockquote>\n

The two main properties that are returned are called GroupComponent<\/strong> and PartComponent<\/strong>—they do not even sound too exciting. However, as seen in the following image, these two properties point to the key property of their respective classes. <\/p>\n

\"Image<\/a><\/p>\n

This is exciting! The reason is that the PartComponent<\/strong> and GroupComponent<\/strong> properties contain the path to a specific instance of a WMI class. Compare the __Path<\/strong> property from the query below with the value of the PartComponent<\/strong> property seen above. They are the same. <\/p>\n

\n

PS C:\\> gwmi win32_baseservice -Filter “name = ‘acpi'” | fl *<\/p>\n

Status                           : OK
Name                            : ACPI
State                             : Running
ExitCode                       : 0
Started                          : True
ServiceSpecificExitCode : 0
__GENUS                       : 2
__CLASS                        : Win32_SystemDriver
__SUPERCLASS              : Win32_BaseService
__DYNASTY                    : CIM_ManagedSystemElement
__RELPATH                    : Win32_SystemDriver.Name=”ACPI”
__PROPERTY_COUNT     : 22
__DERIVATION               : {Win32_BaseService, CIM_Service, CIM_LogicalElement, CIM_M
                                         anagedSystemElement}
__SERVER                      : MRED1
__NAMESPACE               : root\\cimv2
__PATH                          : \\\\MRED1\\root\\cimv2:Win32_SystemDriver.Name=”ACPI”
AcceptPause                  : False
AcceptStop                    : True
Caption                          : Microsoft ACPI Driver
CreationClassName       : Win32_SystemDriver
Description                     : Microsoft ACPI Driver
DesktopInteract             : False
DisplayName                  : Microsoft ACPI Driver
ErrorControl                   : Critical
InstallDate                     :
PathName                      : C:\\Windows\\system32\\DRIVERS\\ACPI.sys
ServiceType                    : Kernel Driver
StartMode                      : Boot
StartName                      :
SystemCreationClassName : Win32_ComputerSystem
SystemName                  : MRED1
TagId : 1
Scope                             : System.Management.ManagementScope
Path                               : \\\\MRED1\\root\\cimv2:Win32_SystemDriver.Name=”ACPI”
Options                          : System.Management.ObjectGetOptions
ClassPath                       : \\\\MRED1\\root\\cimv2:Win32_SystemDriver
Properties                      : {AcceptPause, AcceptStop, Caption, CreationClassName…}
SystemProperties           : {__GENUS, __CLASS, __SUPERCLASS, __DYNASTY…}
Qualifiers                        : {dynamic, Locale, provider, UUID}
Site                                 :
Container                       :<\/p>\n

PS C:\\><\/p>\n<\/blockquote>\n

One of the things that makes using the [WMI]<\/strong> type accelerator difficult to use is that it requires a key to a specific instance of a WMI class. But the cool thing is we get keys to specific instances of classes for free when using a WMI association class. This makes working with association classes extremely flexible and easy when using Windows PowerShell. <\/p>\n

The GroupComponent<\/strong> and the PartComponent<\/strong> properties are described as a reference to another class. The reference to the other class is the key to the class in path form, and when using the [WMI]<\/strong> type accelerator, we use the path to the other class to return an instance of that class. This means that all of the properties from the Win32_BaseService<\/strong> and Win32_LoadOrderGroup<\/strong> are available to us. <\/p>\n

It is this reference to another WMI class concept that fakes students of WMI out at first glance. They see the property GroupOrder<\/strong> or Started<\/strong> being used in the script, and wonder from where it comes. The properties are coming from the referenced WMI classes. The results of the Get-WmiObject<\/strong> WMI query are piped to the ForEach-Object cmdlet<\/a> to allow us to work with each object as it comes across the pipeline<\/a>. This is shown here:<\/p>\n

\n

Get-WmiObject -Class win32_LoadOrderGroupServiceMembers |<\/p>\n

ForEach-Object {<\/p>\n<\/blockquote>\n

Because we want to return information from each of the two WMI classes that are referenced, I decided to use the New-Object<\/strong> cmdlet to create a new object, and then use a hash table to add four properties to the object. The properties are the group order number, the name of the group, the service name, and whether the service is started. This section of the script is shown here:<\/p>\n

\n

New-Object -TypeName psobject -Property `<\/p>\n

   @{<\/p>\n

     “GroupOrder”=([wmi]$_.GroupComponent).GroupOrder<\/p>\n

     “GroupName”=([wmi]$_.GroupComponent).Name<\/p>\n

     “ServiceName”=([wmi]$_.PartComponent).Name<\/p>\n

     “Started”=([wmi]$_.PartComponent).Started<\/p>\n

    }<\/p>\n<\/blockquote>\n

The cool thing about creating a custom Windows PowerShell object is that regular Windows PowerShell cmdlets can be used to manipulate the results that come from the query. Therefore, the first thing I am interested in seeing is only the services that are started. The Where-Object<\/strong> cmdlet is used to filter out only services that are started. Because the started property is a Boolean value, we can use a shortcut method as shown here: <\/p>\n

\n

Where-Object { $_.started } |<\/p>\n<\/blockquote>\n

The above command is the same as saying only return objects that have a value for the started property of $true<\/strong>. This command is shown here:<\/p>\n

\n

Where-Object { $_.started -eq $true }<\/p>\n<\/blockquote>\n

After the started services have been filtered, they are piped to the Sort-Object<\/strong> cmdlet, which is used to sort the services into their start order group in a descending fashion. This portion of the command is shown here:<\/p>\n

\n

Sort-Object -Property grouporder –Descending<\/p>\n<\/blockquote>\n

When the script runs, the output is displayed that is shown in the following image. <\/p>\n

\"Image<\/a><\/p>\n

RY, that is all there is to using WMI to display the service load groups for running services. This also concludes WMI Week. Join us tomorrow for Quick-Hits Friday<\/a>.<\/p>\n

We would love for you to follow us on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to us at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum.<\/a>. See you tomorrow. Until then, peace.<\/p>\n

 <\/p>\n

Ed Wilson and Craig Liebendorfer, Scripting Guys<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

Summary: The Microsoft Scripting Guys show how to determine service launch order by using Windows PowerShell and WMI in this helpful step-by-step article.   Hey, Scripting Guy! I need to find out the order in which services start on my computer. To properly shut down a computer, the services should stop in reverse order that […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[31,3,4,39,45,6],"class_list":["post-17241","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-operating-system","tag-scripting-guy","tag-scripting-techniques","tag-services","tag-windows-powershell","tag-wmi"],"acf":[],"blog_post_summary":"

Summary: The Microsoft Scripting Guys show how to determine service launch order by using Windows PowerShell and WMI in this helpful step-by-step article.   Hey, Scripting Guy! I need to find out the order in which services start on my computer. To properly shut down a computer, the services should stop in reverse order that […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/17241","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=17241"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/17241\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=17241"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=17241"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=17241"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}