Services collector

The Services collector lists services installed on managed devices.

Collector output

Field	Type	Description
description	String	A description of the service's functionality.
name	String	A short name that uniquely identifies the service.
startuptype	String	The start-up mode. Boot — specifies a device driver started by the operating system loader. System — specifies a device driver started by the operating system. Automatic — specifies a service that starts automatically at system start-up. Manual — specifies a service started by the service control manager. Disabled — specifies a service that can no longer be started.
status	String	The current status of the service.
user	String	The user that owns the service's process.

Supported versions

Windows	Linux	macOS
3.0 and later	3.0 and later	3.0 and later

Example: Show services that are currently running and are set to start manually by users.

Services where Services status equals "Running" and Services startuptype equals "Manually"

Which have services startup: manual

Services startuptype, name, user, status
    WHERE Services startuptype equals "Manual"

Which have services startup: automatic

Services startuptype, name, user, status
    WHERE Services startuptype equals "Automatic"

Which services are running

Services startuptype, name, user, status
    WHERE Services status equals "Running"

Which services are not running

Services startuptype, name, user, status
    WHERE Services status equals "Stopped"

Which services running as non-system identities

Services startuptype, name, user, status
    WHERE Services status equals "Running"
        AND Services user not equals "LocalService"
        AND Services user not equals "LocalSystem"
        AND Services user not contains "NT AUTHORITY\"
        AND Services user not contains "NT Service\"