Shawn Samuels (Customer) asked a question.

Edited by Mike Rockwell July 14, 2026 at 12:32 PM
Powershell to monitor all Windows Services set to "Automatic".

Hi, I'm posting this as is. Maybe it'll help someone else out. We were looking for a way to monitor many window services at once, but not all services. Trying to set up one service monitor at a time was going to be prohibitive. We hit on using a powershell script and to monitor anything set to Automatic. We included an "ignore list" where we could add services that are not always running so they don't generate false positives. Took about two weeks to build out our list. YMMV. We used the Services' Display Name as the value to use in the ignore list but you could change that.

 

PowerShell Active Monitor

Name: Windows Services Monitor

Description: PowerShell monitor - This monitors Windows Server Services that are set to Automatic. If the service is set to Automatic and is not running an alert will be generated.

Timeout: 60 Seconds

Script Text:

 

  1. # WhatsUp Gold Active Script Monitor (PowerShell)
  2.  
  3. # Windows Services: Automatic but Not Running (WMI)
  4.  
  5. # Includes an ignore list by DisplayName (exact match)
  6.  
  8.  
  9. $rc = 0
  10.  
  11. $msg = ""
  12.  
  14.  
  15. try {
  16.  
  17. $addr = [string]$Context.GetProperty("Address")
  18.  
  19. $user = [string]$Context.GetProperty("CredWindows:DomainAndUserid")
  20.  
  21. $pass = [string]$Context.GetProperty("CredWindows:Password")
  22.  
  24.  
  25. if ([string]::IsNullOrEmpty($user) -or [string]::IsNullOrEmpty($pass)) {
  26.  
  27. throw "Missing Windows credential (CredWindows) on this device."
  28.  
  29. }
  30.  
  32.  
  33. $sec = ConvertTo-SecureString $pass -AsPlainText -Force
  34.  
  35. $cred = New-Object System.Management.Automation.PSCredential($user, $sec)
  36.  
  38.  
  39. # Pull services that should be running (Automatic) but are not
  40.  
  41. $svc = Get-WmiObject -Class Win32_Service -ComputerName $addr -Credential $cred -Filter "StartMode='Auto' AND State<>'Running'"
  42.  
  44.  
  45. # -----------------------------
  46.  
  47. # IGNORE LIST (DisplayName)
  48.  
  49. # -----------------------------
  50.  
  51. $ignore = @(
  52.  
  53. "Microsoft Edge Update Service (edgeupdate)",
  54.  
  55. "AppX Deployment Service (AppXSVC)",
  56.  
  57. "Background Intelligent Transfer Service",
  58.  
  59. "Connected Devices Platform Service",
  60.  
  61. "Downloaded Maps Manager",
  62.  
  63. "Delivery Optimization",
  64.  
  65. "Device Management Wireless Application Protocol (WAP) Push message Routing Service",
  66.  
  67. "Google Updater Internal Service (GoogleUpdaterInternalService147.0.7703.0)",
  68.  
  69. "Google Updater Service (GoogleUpdaterService147.0.7703.0)",
  70.  
  71. "Google Updater Internal Service (GoogleUpdaterInternalService148.0.7730.0)",
  72.  
  73. "Google Updater Service (GoogleUpdaterService148.0.7730.0)",
  74.  
  75. "Group Policy Client",
  76.  
  77. "MDM Integration Service",
  78.  
  79. "Windows Biometric Service",
  80.  
  81. "Remote Registry",
  82.  
  83. "SharePoint Migration Service",
  84.  
  85. "Software Protection",
  86.  
  87. "SysMain",
  88.  
  89. "Volume Shadow Copy",
  90.  
  91. "wuauserv",
  92.  
  93. "Windows Modules Installer",
  94.  
  95. "Windows Time",
  96.  
  97. "Windows Update"
  98.  
  99. )
  100.  
  102.  
  103. # Remove ignored services
  104.  
  105. $svc = $svc | Where-Object { $ignore -notcontains $_.DisplayName }
  106.  
  108.  
  109. # If anything remains, alert DOWN and list them
  110.  
  111. if ($svc) {
  112.  
  113. $rc = 1
  114.  
  115. $lines = @()
  116.  
  117. foreach ($s in $svc) {
  118.  
  119. $lines += ($s.DisplayName + " [" + $s.Name + "] State=" + $s.State)
  120.  
  121. }
  122.  
  123. $msg = "Automatic services NOT running on " + $addr + ":`r`n" + ($lines -join "`r`n")
  124.  
  125. }
  126.  
  127. else {
  128.  
  129. $msg = "OK - All Automatic services are running (after ignore list) on " + $addr + "."
  130.  
  131. }
  132.  
  133. }
  134.  
  135. catch {
  136.  
  137. $rc = 1
  138.  
  139. $msg = "Script error: " + $_.Exception.Message
  140.  
  141. }
  142.  
  144.  
  145. $Context.SetResult($rc, $msg)

 

  • 2 answers
  • 245 views
Nichol Goldstein likes this.

  • Davey Flavin (Progress Software)

    @Shawn Samuels (Customer)​ 

     

    Thank you very much for sharing this - I'm sure someone will get use out of this.

     

    Just so you are aware, it is possible to bulk create service monitors as part of the creation process - We have a multi selection for this exact scenario

     

    image 

    imageLet me know if you have any questions on this and if I can help further

  • Mike Rockwell (Progress Software)

    I edited your post to use the script block function to make your code easier to read and copy.