listing existing windows services with python

[News123]

Hi,


What is the best way with python to get a list of all windows services.

As a start I would be glad to receive only the service names.

However it would be nicer if I could get all the properties of a service
as well.

Thanks for any info and bye


N

 

[Alf P. Steinbach]

* News123:

Hi,


What is the best way with python to get a list of all windows services.

As a start I would be glad to receive only the service names.

However it would be nicer if I could get all the properties of a service
as well.

Thanks for any info and bye

* Library:

If there is some existing library for that (just search the web) then that
would probably be the easiest.

* Registry functions:

Otherwise, I'd use the general registry access functions.

Info about the registry access functions is available in your Python docs.

All the information about services is in the Windows registry (documented in
the MSDN Library, which is available in a browsable on-line version at
Microsoft).

* Text-oriented commands:

An alternative to using the registry access functions is to capture the output
of e.g. the 'sc' command.

The 'net' command also has some functionality related to services, e.g.
'net start'.


Cheers & hth.,

- Alf

 

[alex23]

What is the best way with python to get a list of all windows services.

As a start I would be glad to receive only the service names.

However it would be nicer if I could get all the properties of a service
as well.

I highly recommend Tim Golden's fantastic WMI module[1].

>>> import wmi
>>> c = wmi.WMI()
>>> services = c.Win32_Service()
>>> s = services[0]
>>> s

<_wmi_object: \\LIB-D5NYF1S\root
\cimv2:Win32_Service.Name="Alerter"> {u'DisplayName': None, u'ServiceSpecificExitCode': None, u'State':
None, u'Syste
mName': None, u'ErrorControl': None, u'Status': None,
u'ProcessId': None, u'Desc
ription': None, u'Started': None, u'AcceptStop': None,
u'CheckPoint': None, u'Pa
thName': None, u'WaitHint': None, u'Name': None, u'InstallDate':
None, u'Caption
': None, u'StartMode': None, u'DesktopInteract': None,
u'ServiceType': None, u'T
agId': None, u'StartName': None, u'AcceptPause': None,
u'CreationClassName': Non
e, u'SystemCreationClassName': None, u'ExitCode': None} u'Share Process'

1: http://timgolden.me.uk/python/wmi/index.html

 

[Alf P. Steinbach]

* alex23:

What is the best way with python to get a list of all windows services.

As a start I would be glad to receive only the service names.

However it would be nicer if I could get all the properties of a service
as well.

I highly recommend Tim Golden's fantastic WMI module[1].

It's probably Very Good, but one Microsoft-thing one should be aware of: using
WMI functionality generally starts up a background WMI service...

Similarly, starting the standard clipboard viewer (discontinued in Windows
Vista) starts up a silly copy-clipboard-contents-over-network service.

On a low-range machine the WMI service can be a resource concern.

I don't know whether the WMI service is a security concern (it probably is,
considering IIS and anything Microsoft+Network and that WMI is meant to
administrate machines over network, it's an enterprise thing not a personal
computer user thing), but the clipboard service is, as I recall, a concern.

import wmi
c = wmi.WMI()
services = c.Win32_Service()
s = services[0]
s

<_wmi_object: \\LIB-D5NYF1S\root
\cimv2:Win32_Service.Name="Alerter">{u'DisplayName': None, u'ServiceSpecificExitCode': None, u'State':
None, u'Syste
mName': None, u'ErrorControl': None, u'Status': None,
u'ProcessId': None, u'Desc
ription': None, u'Started': None, u'AcceptStop': None,
u'CheckPoint': None, u'Pa
thName': None, u'WaitHint': None, u'Name': None, u'InstallDate':
None, u'Caption
': None, u'StartMode': None, u'DesktopInteract': None,
u'ServiceType': None, u'T
agId': None, u'StartName': None, u'AcceptPause': None,
u'CreationClassName': Non
e, u'SystemCreationClassName': None, u'ExitCode': None}u'Share Process'

1: http://timgolden.me.uk/python/wmi/index.html

Cheers,

- Alf

 

[alex23]

It's probably Very Good, but one Microsoft-thing one should be aware of: using
WMI functionality generally starts up a background WMI service...

"Probably"? You haven't even used the module but you felt the need to
contribute anyway? And I see that my suggestion is "probably" a
security concern too. Would it be too much to ask for you to provide
something other than unrelated anecdotes as evidence to support these
claims? Or perhaps produce an alternative solution[1] for the OP
instead of shitting over a working solution?

So you chose to post to share your vague unsubstantiated concerns
while offering the sterling advice that a developer need be familiar
with a system in order to be aware of the costs in using it. Clearly
time well spent by all.

1: http://essiene.blogspot.com/2005/04/python-windows-services.html

 

[Alf P. Steinbach]

* alex23:

"Probably"?

That means that since you say it's fantastic, it's probably very good.
"Probably" is a way to qualify the statement. Based on your earlier and current
quite emotional mode of expression I wouldn't take your word for an evaluation.

You haven't even used the module but you felt the need to
contribute anyway?

Yes, since I did not contribute about the module, but rather about the
functionality that it uses, which you didn't mention in your otherwise excellent
reply to the OP.

And I see that my suggestion is "probably" a security concern too.

Yeah. It has nothing to do with the module, though. Only with Microsoft's WMI.

Would it be too much to ask for you to provide
something other than unrelated anecdotes as evidence to support these
claims?

Google it.

E.g. <url: http://www.google.com/search?wmi+exploit>.

Other words and search engines might turn up other things, but the description
of not a security "hole" but a security "crater" seems to me to indicate that
it's not 100% secure.

Or perhaps produce an alternative solution[1] for the OP
instead of shitting over a working solution?

Oh yes, the confusion that technical facts are somehow an expression of personal
feelings and social matters, and can be chosen as one pleases, hence, that
providing a fact or pointing out a possibility that is unwanted, is "shitting".

From my point of view that's stupid.

But I also think that apart from your "shitting" on me (and there the analogy is
more apt, it's not about technical facts) it's great that you provide the kind
of help that you did, pointing out a probably very good module that it seems
gives the required functionality, and giving an URL.


[snip further speculative insults]


Cheers & hth.,

- Alf

 

[alex23]

it's great that you provide the kind
of help that you did, pointing out a probably very good module that it seems
gives the required functionality, and giving an URL.

Yes, because that's _actually helping people_ and not just
contributing the usual self-serving pontificating nonsense that just
_flows_ from your goddamn mouth like a river of effluent
psuedotruths.

If you really wanted to help you would've cited _actual security
flaws_ in your first response to me, instead of hand waving us away
to once again do the leg work of verification. Based on your postings
here, you regularly don't have the time or inclination to back up some
of the bizarre claims you make. It would actually improve the signal
in this channel a lot if you just chose not to make those posts at all.

 

[Alf P. Steinbach]

* alex23:

Yes, because that's _actually helping people_ and not just
contributing the usual self-serving pontificating nonsense that just
_flows_ from your goddamn mouth like a river of effluent
psuedotruths.

That's an off-topic personal attack, and it's completely untrue.

You're wasting bandwidth.

If you really wanted to help you would've cited _actual security
flaws_ in your first response to me, instead of hand waving us away
to once again do the leg work of verification.

Posting two ranting and raving articles complaining about 1 (one) line or so in
an earlier article, just because you personally wouldn't want to know that,
that's a total waste of the reader's time.

Disregarding the negative emotional adjectives you add everywhere, it's a good
heuristic to post what you would want to know.

I would want to know that a service is started, that it's designed for net based
administration by Microsoft, and that so it might constitute a security risk.

And so I added that information, each point of which is relevant. If you don't
want to know about the "probably" little thing you can just skim over it. If
you're unable to do that then something's wrong with you.

Based on your postings
here, you regularly don't have the time or inclination to back up some
of the bizarre claims you make. It would actually improve the signal
in this channel a lot if you just chose not to make those posts at all.

That an off-topic personal attack, and it's completely untrue.

Another poster (not me) has described you in an article here as a sockpuppet
(false identity being in reality another poster here) and a troll; I believe at
least the troll bit.

It would reduce the noise level a bit if you stopped contributing noise like above.


Cheers,

- Alf

 

[News123]

Thanks for your answers,




The security wouldn't be a concern, as I would run while being only
accessible by trusted hosts.

I don't use the script often, so if it would start a WMI service during
runtime and stop it afterwards it would be fine.

I just wonder whether installing another 3rd party package for just
listing all services s worth the effort.


In my current case I'll go probably for parsing the output of
"sc.exe query" or I'll traverse the registry.

currently I just want to get a list of the names of the running services.


bye


N

* alex23:

What is the best way with python to get a list of all windows services.

As a start I would be glad to receive only the service names.

However it would be nicer if I could get all the properties of a service
as well.

I highly recommend Tim Golden's fantastic WMI module[1].

It's probably Very Good, but one Microsoft-thing one should be aware of:
using WMI functionality generally starts up a background WMI service...

Similarly, starting the standard clipboard viewer (discontinued in
Windows Vista) starts up a silly copy-clipboard-contents-over-network
service.

On a low-range machine the WMI service can be a resource concern.

I don't know whether the WMI service is a security concern (it probably
is, considering IIS and anything Microsoft+Network and that WMI is meant
to administrate machines over network, it's an enterprise thing not a
personal computer user thing), but the clipboard service is, as I
recall, a concern.

import wmi
c = wmi.WMI()
services = c.Win32_Service()
s = services[0]
s

<_wmi_object: \\LIB-D5NYF1S\root
\cimv2:Win32_Service.Name="Alerter">

s.properties

{u'DisplayName': None, u'ServiceSpecificExitCode': None, u'State':
None, u'Syste
mName': None, u'ErrorControl': None, u'Status': None,
u'ProcessId': None, u'Desc
ription': None, u'Started': None, u'AcceptStop': None,
u'CheckPoint': None, u'Pa
thName': None, u'WaitHint': None, u'Name': None, u'InstallDate':
None, u'Caption
': None, u'StartMode': None, u'DesktopInteract': None,
u'ServiceType': None, u'T
agId': None, u'StartName': None, u'AcceptPause': None,
u'CreationClassName': Non
e, u'SystemCreationClassName': None, u'ExitCode': None}

s.Name u'Alerter'
False
s.ServiceType

u'Share Process'

1: http://timgolden.me.uk/python/wmi/index.html

Cheers,

- Alf

 

[Tim Golden]

I don't use the script often, so if it would start a WMI service during
runtime and stop it afterwards it would be fine.

FWIW -- your other considerations notwithstanding -- I'm not aware
of WMI having this effect. Generally you can assume that the WMI
services are running (or not, if someone's shut them off) but
I've never heard of them being started up by virtue of a call
to the WMI subsystem and then stopped afterwards.

That said, I'd be interested if someone did have a pointer for this;
worth putting a caveat in the docs if that were the case.

TJG

 

[Alf P. Steinbach]

* Tim Golden:

FWIW -- your other considerations notwithstanding -- I'm not aware
of WMI having this effect. Generally you can assume that the WMI
services are running (or not, if someone's shut them off) but
I've never heard of them being started up by virtue of a call
to the WMI subsystem and then stopped afterwards.

That said, I'd be interested if someone did have a pointer for this;
worth putting a caveat in the docs if that were the case.

TJG

I just googled the filename from memory, found

<url: http://www.neuber.com/taskmanager/process/wmiprvse.exe.html>

Don't know if I've disabled it because invoking wmic didn't produce it.

Uh, wait, since it hosts the provider service(s), perhaps...

Yes, 'wmic service list brief' which actually retrieves some information (I
guess it can be anything, I remembered this from listing process command lines)
started an [wmprvse.exe] process.

It terminated after the query/usage, but as I recall in some cases it doesn't.

I don't know how that works with programmatic access, but it's worth checking out.


Cheers,

- Alf

 

[Tim Golden]

I just googled the filename from memory, found

<url: http://www.neuber.com/taskmanager/process/wmiprvse.exe.html>

Don't know if I've disabled it because invoking wmic didn't produce it.

Uh, wait, since it hosts the provider service(s), perhaps...

Yes, 'wmic service list brief' which actually retrieves some information (I
guess it can be anything, I remembered this from listing process command lines)
started an [wmprvse.exe] process.

It terminated after the query/usage, but as I recall in some cases it doesn't.

I don't know how that works with programmatic access, but it's worth checking out.

Thanks. As I understand it, you're not talking about a *service* starting up
or shutting down; rather a *process* starting up etc., presumably controlled
by the underlying service?

I'll do some further research to see what's going on there.

TJG

 

[Alf P. Steinbach]

* Tim Golden:

I just googled the filename from memory, found

<url: http://www.neuber.com/taskmanager/process/wmiprvse.exe.html>

Don't know if I've disabled it because invoking wmic didn't produce it.

Uh, wait, since it hosts the provider service(s), perhaps...

Yes, 'wmic service list brief' which actually retrieves some
information (I
guess it can be anything, I remembered this from listing process
command lines)
started an [wmprvse.exe] process.

It terminated after the query/usage, but as I recall in some cases it
doesn't.

I don't know how that works with programmatic access, but it's worth
checking out.

Thanks. As I understand it, you're not talking about a *service*
starting up
or shutting down; rather a *process* starting up etc., presumably
controlled
by the underlying service?

It doesn't seem to provide ordinary Windows "service"s, but it's a bit unclear
since e.g. the URL above says


<quote>
Beginning with Windows XP, WMI resides in a shared service host with several
other services. To avoid stopping all the services when a provider fails,
providers are loaded into a separate host process named Wmiprvse.exe. Multiple
instances of Wmiprvse.exe can run at the same time under different accounts:
LocalSystem, NetworkService or LocalService. The WMI core WinMgmt.exe is loaded
into the shared Local Service host named Svchost.exe.
Note: wmiprvsw.exe is the Sasser worm!

Note: The wmiprvse.exe file is located in the folder C:\WINDOWS\System32\Wbem.
In other cases, wmiprvse.exe is a virus, spyware, trojan or worm! Check this
with Security Task Manager.
</quote>


Checking for ordinary Windows services:

<example>
C:\test> (wmic service list >nul) & tasklist /svc /fi "imagename eq wmiprvse.exe"

Image Name PID Services
========================= ====== =============================================
wmiprvse.exe 1076 N/A

C:\test> _
</example>

I'll do some further research to see what's going on there.

Cheers,

- Alf (is this off-topic for the group?)

 

[Martin P. Hellwig]

On 02/16/10 13:51, Alf P. Steinbach wrote:

- Alf (is this off-topic for the group?)

Strictly speaking yes, but I do find it interesting and there is nothing
wrong with ignoring posts you don't like to read.

 

[ssteinerX]

Please, don't send the above kind of vitriol to this public forum.
Better yet, compose it in your editor, bask in what you've written, then delete it unsent.

+1

If you kids want to have some sort of pissing-in-your-sockpuppet type of contest to see who can out-whatever each other, do it off-list and don't waste everyone else's time with.

What ever happened to "don't feed the trolls" ?? If you really believe someone's trolling, don't answer, block them, and move on.

Providing a lengthy, well-reasoned reply only shows that they've pulled you into the troll pit for a fight with them, regardless of whether you're "right."

S

 

[Steve Holden]

Alf P. Steinbach wrote:
[...]

Cheers,

- Alf (is this off-topic for the group?)

It's gone a lot further off than this without anyone complaining. I
think your experiences to date should convince you that you can rely on
being told when you drift too far off-topic

regards
Steve

 

[Alf P. Steinbach]

* Steve Holden:

Alf P. Steinbach wrote:
[...]

Cheers,

- Alf (is this off-topic for the group?)

It's gone a lot further off than this without anyone complaining. I
think your experiences to date should convince you that you can rely on
being told when you drift too far off-topic

Some old folks' music, Eternity's Breath & Stratus; the guy playing is 65:

<url:

>

Hip hoppers may skip the 80 seconds complicated intro.

It is relevant in a way, although very indirectly. For although the comment did
not pop up here, many Satch videos (this is not Satch) have comments like "How
on Earth can he remember all those notes?"

And he doesn't.

It's not memorization: one can't create at this level by memorizing notes or rules.

It's an understanding of the tool one uses and what one wants to create and the
basic themes, and in this video it's also the synergy effect of four people
doing that, creating together something they can't quite believe they're doing,
so you have four madly grinning world class musicians -- and audience...


- Alf

 

[David Bolen]

What is the best way with python to get a list of all windows services.

As a start I would be glad to receive only the service names.

However it would be nicer if I could get all the properties of a service
as well.

I highly recommend Tim Golden's fantastic WMI module[1].

Another alternative is the win32service module from the pywin32
package (which IMO you'll almost certainly want available when doing
any significant Windows-specific operations) which wraps the native
win32 libraries for enumerating, querying and controlling services.

A simple loop could use EnumServicesStatus to iterate through the
services, OpenService with the SERVICE_QUERY_CONFIG flag to get a
handle to each service, and then QueryServiceConfig to retrieve
configuration information.

Since pywin32 is a relatively thin wrapper over the win32 libraries,
pure MSDN documentation can be used for help with the calls, augmented
by any Python-related information contained in the pywin32
documentation.

-- David

 

[News123]

Hi David,


Thanks a lot.

As I have pywin32 already installed this is probbaly the way to go.

Meanwhile I implemented already a small module, which is parsing
sc.exe's output, but probably 'll change it as my implementation is a
little clumsy.


bye


N

What is the best way with python to get a list of all windows services.

As a start I would be glad to receive only the service names.

However it would be nicer if I could get all the properties of a service
as well.

I highly recommend Tim Golden's fantastic WMI module[1].

Another alternative is the win32service module from the pywin32
package (which IMO you'll almost certainly want available when doing
any significant Windows-specific operations) which wraps the native
win32 libraries for enumerating, querying and controlling services.

A simple loop could use EnumServicesStatus to iterate through the
services, OpenService with the SERVICE_QUERY_CONFIG flag to get a
handle to each service, and then QueryServiceConfig to retrieve
configuration information.

Since pywin32 is a relatively thin wrapper over the win32 libraries,
pure MSDN documentation can be used for help with the calls, augmented
by any Python-related information contained in the pywin32
documentation.

-- David

 

[Tim Golden]

It doesn't seem to provide ordinary Windows "service"s, but it's a bit unclear
since e.g. the URL above says

[... snip ...]

Well the useful info in there appears to come from:

http://msdn.microsoft.com/en-us/library/aa392783(VS.85).aspx

Looking around the matter, I think I'm taking the view that this
is an implementation detail of WMI.

However you use it, WMI is a layer on a layer on layer
(especially if you're using it in Python with my module!)
and it's never going to be the fastest thing going. One
contributory factor will be this particular model of
process-within-process. But I don't feel that it would
help anybody if I were to mention it on my webpages as
there's nothing the casual user can do about it.

In general I tend to unrecommend WMI for something small
in an app which doesn't otherwise use it, unless the
convenience (and it *is* very convenient sometimes)
outweighs the slight performance issue.

Thanks for the heads-up anyway, Alf. I need to get up
to speed with the Vista & W7 issues referred to on
that page as well.

TJG