PowerShell script to identify and stop one specific service - powershell

I try to make a PowerShell script to do the following:
I want to identify the antivirus running on my PC.
I use command to do that:
$AntiVirusProduct = Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct
Write-Output $AntiVirusProduct.DisplayName
Here I get the antivirus name but, I don't know how to grep the antivirus name and put it to the next command.
The next command is:
Stop-Service -Force "$Antivirus Name"
Or if there is a better way to to this?
Edit
Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct |
Select DisplayName
DisplayName
-----------
AVG Antivirus
Windows Defender

If your display name output is a list of service names you can remove the Windows Defender entry from the list with something like this:
$svc = $AntiVirusProduct.DisplayName |
Where-Object { $_ -notlike '*Windows Defender*' }
and then stop the service like this:
$svc | Stop-Service -Force

Related

How do i get power shell to show a few services from my servers and not them all

this is my code i want it to show a few services from my servers but it keeps showing all of them. i tried using -Name but power shell 7 keeps saying that doesn't exist please help
$offlineServices = (Invoke-Command -ComputerName $server.Name {Get-service [string]$server.Value | `
Where-Object{$_.status -eq 'Stopped'}} ).Name
Get-Service can be used directly against remote servers, like this:
Get-Service -Name $server.Value -ComputerName $server.Name |
Where-Object Status -eq 'Stopped'
If you want to stick with your original remoting technique, you need to use the using modifier:
$offlineServices = (Invoke-Command -ComputerName $server.Name -Script {Get-service $using:server.Value |
Where-Object Status -eq 'Stopped'}).Name
NOTE: you should also remove the backtick before Where-Object as it isn't needed and might cause you issue later when modifying/debugging the code.

Discover and install network printers via powershell

I am new to PowerShell and I am trying to write a script that will install a series of network printers for me. To get me started I was looking for a way to find all shared printers on a print server and then install them locally. Here is something that doesn't work but gets the idea across. One thing to note is that this is this script is being run on a win 2008 server.
Get-WmiObject -computername $printServer -class Win32_Printer | Where {$_.name -notlike "Microsoft*"} | add-printer -connectionname \\$_.systemName\$_.shareName
I don't currently have a way to test this but I believe that this may work for you.
$printClass = [wmiclass]"win32_printer"
Get-WmiObject -computername $printServer -class Win32_Printer | ? {$_.name -notlike "Microsoft*"} | % { $printClass.AddPrinterConnection([string]::Concat("\\", $_.systemName, "\", $_.shareName)) }

Kill multiple processes running from a given path on remote machine

I have a following problem:
I'm in need of a code that will close all running process from a given path on a remote machine.
So far I've found and came up with those 2 lines but none of them actually work.
Get-Process | Where-Object {$_.Path -like "\\$computername\C$\Program Files (x86)\Adobe\Adobe Reader 10.0\Reader\**"} | Stop-Process -Force
This is the second line I've found but still does not want to work with me :)
Get-WmiObject Win32_Process -Filter "ExecutablePath LIKE '\\$computername\C$\Program Files (x86)\Adobe\Adobe Reader 10.0\Reader\'" -ComputerName $computername | Invoke-WmiMethod -Name Terminate
I will be happy to get some advice. Belive that this is something rather simple to do..I hope that is.. :)
Something like this should work:
(Get-WmiObject Win32_Process -ComputerName $computerName | ?{ $_.ExecutablePath -like "*Program Files (x86)\Adobe\Adobe Reader 10.0\Reader*" }).Terminate()
You might have to tweak the "like" expression, however.
Another way to approach this is to run that command local to the machine with PSRemoting.
Invoke-Command $computername -script {
Get-Process | Where-Object {$_.Path -like "c:\Program Files (x86)\Adobe\Adobe Reader 10.0\Reader\*"} | Stop-Process -Force
}

Get-WmiObject : The RPC server is unavailable. (Exception from HRESULT: 0x80070 6BA

I have what should be a simple script that will connect to all the servers in a domain and build a table of all the services running on each server. However, when I try to automate the script to grab all the servers in a foreach loop I get an RPC error. If the $name variable is replaced with the server DNS name everything works as expected. I've checked the firewall and DCOM services on my system (win7) and the servers (2000 - 2008R2) and these are all enabled or disabled appropriately. So, I'm thinking something in the script is broke. I'm still learning powershell, so any tips are appreciated.
Here is the script so far.
$servernames = get-adobject -Filter 'ObjectClass -eq "Computer" ' -Searchbase "OU=Servers,DC=E,DC=BENEFIS,DC=ORG"
foreach ($name in $servernames) {
Get-WMIObject win32_service -computername $name -Property SystemName,Name,StartName,StartMode |
Format-table SystemName, Name, Startname >c:\serverservices.txt }
Each object you get back have a name property so you need to pass its value to the ComputerName parameter. In addition, to get computer object use the Get-ADComputer cmdlet, you also need to specify the Append switch when you export to the file otherwise content will be overwritten and what you'll see finally is the output of the last computer only.
$servernames = Get-ADComputer -SearchBase "OU=Servers,DC=E,DC=BENEFIS,DC=ORG" -Filter *
foreach ($name in $servernames)
{
Get-WMIObject win32_service -computername $name.Name -Property SystemName,Name,StartName,StartMode |
Format-table SystemName, Name, Startname | Out-File c:\serverservices.txt -Append
}

Get startup type of Windows service using PowerShell

How can I get the Windows service startup type using PowerShell and not using WMI?
I looked inside the Get-Service command, and it does not provide something to display the "startup type".
With PowerShell version 4:
You can run a command as given below:
Get-Service | select -property name,starttype
WMI is the way to do this.
Get-WmiObject -Query "Select StartMode From Win32_Service Where Name='winmgmt'"
Or
Get-WmiObject -Class Win32_Service -Property StartMode -Filter "Name='Winmgmt'"
In PowerShell you can use the command Set-Service:
Set-Service -Name Winmgmt -StartupType Manual
I haven't found a PowerShell command to view the startup type though. One would assume that the command Get-Service would provide that, but it doesn't seem to.
You can use also:
(Get-Service 'winmgmt').StartType
It returns just the startup type, for example, disabled.
As far as I know there is no “native” PowerShell way of getting this information. And perhaps it is rather the .NET limitation than PowerShell.
Here is the suggestion to add this functionality to the version next:
https://connect.microsoft.com/PowerShell/feedback/details/424948/i-would-like-to-see-the-property-starttype-added-to-get-services
The WMI workaround is also there, just in case. I use this WMI solution for my tasks and it works.
Once you've upgraded to PowerShell version 5 you can get the startup type.
To check the version of PowerShell you're running, use $PSVersionTable.
The examples below are for the Windows Firewall Service:
For the local system
Get-Service | Select-Object -Property Name,Status,StartType | where-object {$_.Name -eq "MpsSvc"} | Format-Table -auto
For one remote system
Get-Service -ComputerName HOSTNAME_OF_SYSTEM | Select-Object -Property MachineName,Name,Status,StartType | where-object {$_.Name -eq "MpsSvc"} | Format-Table -auto
For multiple systems (must create the systems.txt)
Get-Service -ComputerName (Get-content c:\systems.txt) | Select-Object -Property MachineName,Name,Status,StartType | where-object {$_.Name -eq "MpsSvc"} | Format-Table -auto
Use:
Get-Service BITS | Select StartType
Or use:
(Get-Service -Name BITS).StartType
Then
Set-Service BITS -StartupType xxx
[PowerShell 5.1]
If you update to PowerShell 5 you can query all of the services on the machine and display Name and StartType and sort it by StartType for easy viewing:
Get-Service |Select-Object -Property Name,StartType |Sort-Object -Property StartType
You can also use the sc tool to set it.
You can also call it from PowerShell and add additional checks if needed.
The advantage of this tool vs. PowerShell is that the sc tool can also set the start type to auto delayed.
# Get Service status
$Service = "Wecsvc"
sc.exe qc $Service
# Set Service status
$Service = "Wecsvc"
sc.exe config $Service start= delayed-auto
It is possible with PowerShell 4.
Get-Service *spool* | select name,starttype | ft -AutoSize
screenshot
By default StartType is not shown by Get-Service, but you can always explicitly ask for it:
Get-Service | select StartType,DisplayName | sort StartType,DisplayName
Use Get-Service | Get-Member to see all available fields.