Windows sysinternals

198 Part II Usage Guide
example, although most don’t, some services grant the interactive user permission to start
and stop the service. As another example, psservice depend server is the command to list
services that depend on the Server service. The list of services reported will differ for administrators
and nonadministrators on Windows 7 because nonadmins aren’t allowed to read
status information for the HomeGroup Listener service, which depends on Server.
Query
The query command displays status information about services or drivers on the target
system, using flexible criteria to determine which ones to include. For each matching service
or driver, PsService displays the following:
■ Service name The internal name of the service or driver. This is the name that most
sc.exe commands require.
■ Display name The display name, as shown in the Services MMC snap-in.
■ Description The descriptive text associated with the service or driver.
■ Group If specified, the load order group that the service belongs to.
■ Type User-mode services are either own-process or share-process, depending on
whether the service’s process can host other services. User-mode processes can also
be marked “interactive” (although that’s strongly discouraged). Drivers can be kernel
drivers or file system drivers. (File system drivers must register with the I/O manager,
and they interact more extensively with the memory manager.)
■ State Indicates whether the service is running, stopped, or paused, or in transition
with a pending start, stop, pause, or continue. Below this line, PsService shows whether
the service accepts stop or pause/continue commands, and whether it can process
pre-shutdown and shutdown notifications.
■ Win32 exit code Zero indicates normal runtime operation or termination. A non-zero
value indicates a standard error code reported by the service. The value 1066 indicates
a service-specific error. The value 1077 indicates that the service has not been started
since the last boot, which is normal for many services.
■ Service-specific exit code If the Win32 exit code is 1066 (0x42A), this value indicates
a service-specific error code; otherwise, it has no meaning.
■ Checkpoint Normally zero, this value is incremented periodically to report service
progress during lengthy start, stop, pause, or continue operations. It has no meaning
when an operation is not pending.
■ Wait hint The amount of time, in milliseconds, that the service estimates is required
for a pending start, stop, pause, or continue operation. If that amount of time passes
without a change to the State or Checkpoint, it can be assumed that an error has
occurred within the service.
www.it-ebooks.info