Windows sysinternals

Chapter 6 Pstools 199
By default, the PsService query command lists all Win32 services configured on the target
system, whether they’re running or not. (PsService without any command-line parameters is
equivalent to psservice query.) To narrow down the list by service or driver name, specify
the name at the end of the command line. PsService will report status information for all
services and drivers with exact or partially matching service or display names. For example,
psservice query ras will list all services and drivers that have service or display names
beginning with ras. (The match is case insensitive.)
You can further filter the query results by type and by state. Add the –t option followed by
driver to display only drivers, service to display only Win32 services, interactive to display
only Win32 services that are marked allow service to interact with desktop, or all not to
filter results based on type. To filter query results based on whether the service or driver is
active, add –s to the command line followed by active, inactive, or all. If a service name is
not added to the command line, PsService defaults to displaying only Win32 services and
all states. If a service name is specified and –t is not specified, PsService displays matching
services or drivers.
Note It is strongly discouraged to mark services “interactive.” Such services are often vulnerable
to elevation-of-privilege attacks and often will not work on Windows Vista or newer, or on earlier
versions of Windows with Fast User Switching or other terminal services. The psservice query –t
interactive command is an easy way to identify these potentially problematic services.
To list only services or drivers that belong to a particular load order group, name the group
after the –g option. Group name matching is case insensitive but must be an exact match,
not a partial match.
All these options can be combined. The following command displays status information for
kernel drivers on a remote computer that are in the PnP Filter group, that are not loaded,
and that have service or display names beginning with bth:
psservice \\win7x86-vm query -g "pnp filter" -t driver -s inactive bth
Config
The config command displays configuration information about services or drivers. Used by
itself, the PsService config command displays configuration information about all registered
Win32 services on the target system. Add a name after the config command, and PsService
will display configuration settings about all services and drivers with service or display names
beginning with the name you specify. For example, psservice config ras displays configuration
settings for all services and drivers with a service or display name beginning with “ras”
(case insensitive).
www.it-ebooks.info