services

Services of a Windows, by SSH

Returns the state and the start mode of each service of a Windows, stopped services included. Three watches are proposed, each one set on the probe; the first, checked, raises on any service set to start automatically that does not run.

How it works

The collector runs one PowerShell command that reads Win32_Service, one object per service, and in the registry the services whose automatic start is delayed:

powershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding; ConvertTo-Json -Compress -Depth 4 -InputObject @{services = @(Get-CimInstance Win32_Service | Select-Object Name, State, StartMode); delayed = @(Get-ChildItem HKLM:\SYSTEM\CurrentControlSet\Services | Get-ItemProperty -Name DelayedAutostart -ErrorAction SilentlyContinue | Where-Object DelayedAutostart -eq 1 | Select-Object PSChildName)}"

• The delayed start is read in the registry, the value DelayedAutostart at 1 under the key of the service: Win32_Service does not serve it on every Windows from Server 2012 on. A key the account may not read is skipped: its service, if automatic, is then judged as an automatic one without delay.

• A service is named by its service name (wuauserv, Spooler, MSSQLSERVER), the same in every language of Windows; never by its display name, which is translated.
• The state and the start mode are written by WMI in English whatever the language of the system. They are returned in lower case, words joined by -: - state: running, stopped, start-pending, stop-pending, paused, pause-pending, continue-pending; - start mode: auto, delayed (automatic, delayed start), manual, disabled, boot, system.
• "Automatic service stopped" raises, critical, on each service whose start mode is auto and whose state is not running. A service in delayed automatic start is left to it: Windows may stop it once its work is done.
• The default selection is every service but RemoteRegistry, which Windows Server sets to start automatically on a trigger and stops when it is idle. Leave out on the probe any other service that starts and stops on its own.
• Nothing is skipped at the first run.
• No service at all, or an answer that is not the expected JSON, stops the collector as misconfigured.

Nothing is written to the Windows: the command only reads.

Prerequisites

• The OpenSSH server of Windows, installed and started: - on Windows Server 2019 and later, Windows 10 (version 1809 and later) and Windows 11, where it is built in: the optional feature "OpenSSH Server" (Settings, Optional features; or Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 in PowerShell), then the service sshd started and set to start automatically; - on Windows Server 2012, 2012 R2 and 2016, Windows 8, 8.1 and the earlier Windows 10, where it is not built in: OpenSSH for Windows installed from its Microsoft release (Win32-OpenSSH), then the service sshd started and set to start automatically.
• The default shell of the OpenSSH server left at cmd.exe, as it is installed: the collector starts PowerShell itself, and a command meant for cmd.exe would be read differently by a PowerShell default shell.
• Windows PowerShell 3.0 or later, as shipped with every Windows from Server 2012 and Windows 8 on (3.0 on Server 2012, 4.0 on 2012 R2, 5.1 from 2016 on).
• An account for monitoring, without administrator rights, member of the local groups "Performance Monitor Users" and "Event Log Readers", so that the performance counters and the System log are not refused to it. banshee reads it in protocol:ssh:user, with its password in protocol:ssh:password or its key in protocol:ssh:private-key (the public key then in C:\Users\<account>.ssh\authorized_keys).
• The fingerprint of the server's host key, set in protocol:ssh:fingerprint (on the server, C:\ProgramData\ssh\ssh_host_ed25519_key.pub); not needed when the Security settings trust the first SSH fingerprint presented.
• The Windows firewall open to the poller on TCP 22 (the rule "OpenSSH SSH Server (sshd)", created with the feature).

Outputs

Watches

"Service stopped" is for a selection of services that must run whatever their start mode: check it once the selection is set to "Only" those services. "Service missing" looks at every service returned, inside the selection or not: a service named there that is uninstalled raises.

Limits

• A service set to start automatically on a trigger (a device, a network event) may stop on its own: it then raises "Automatic service stopped" until it is left out of the selection.
• A Windows has a few hundred services: the default selection returns them all.
• Not yet checked on a real Windows: that RemoteRegistry starts on a trigger on every Windows Server.