So let's first talk about querying running processes and services.
When we talk about retrieving processes,
it's about retrieving a list of running processes on a specific target.
We can query and return specific process attributes as part of that as well,
as well as retrieving the process memory usage,
and also querying the processes on remote machines if we need to.
To retrieve processes, we can use Get‑Process to just retrieve a full list,
or we can target specific applications like the CalculatorApp,
or we can do multiple, such as the CalculatorApp and Notepad,
and then we can format that out into a list.
If we wish to get attributes of a running process,
for example, we could use Get‑Process the CalculatorApp and then do .Path.
That would give us the path to the executable that's running.
Or we could also retrieve the username, or we could get the FileVersionInfo,
or we could also look for specific processes where it's
using a certain type of username.
We can also retrieve process memory, as well as CPU usage as well.
And this is done by combining some simple math PowerShell with the
Get‑Process and retrieving the property of CPU or VM,
which is your virtual memory,
and then figuring out how we want to calculate those values.
We can also query processes on remote machines,
and the only difference between the commands that we looked at previously is
that we can use ‑ComputerName and then the name of the machine.
So, instead of running Get‑Process and just leaving it,
we're now going to choose Get‑Process ‑ComputerName
and the name of that machine.
And then we can also pass in things like the name of
the application that we wish to get.
Exactly the same for retrieving attributes for the process and also
for retrieving things like the memory and the CPU.
It's exactly the same process.
We just pass the ComputerName and we can retrieve those values.
Now of course we can also retrieve services.
And what we mean by this is retrieve a list of running services.
We can also then query and return specific service attributes for that service.
So we're not talking about the executables or the processes this time,
we're talking about an actual service that's running.
We then have access to the start, stop, suspend,
and restart, as well as being able to query services on remote machines.
So now this process is a little bit simple.
Almost like the same as it was before where we use Get‑Process.
This time we're going to use Get‑Service.
That will retrieve a list of services.
As before,
we can go through and specify the service and we can put it into a list.
And we can also retrieve them from remote computers
by passing in the ‑ComputerName.
We can also retrieve specific attributes.
Now there are not many of them, but we can get things like the DisplayName,
the RequiredServices, maybe DependentServices,
the current status. And we do that by simply utilizing Get‑Service,
the name, parentheses, and then the dot to then signify the property.
Or we can write a full query and say go and get me the
service and then specify a where clause and then create a
table that outputs those values.
Now we can also control the services.
So if I wanted to start the wscsvc or stop it or restart it,
I simply utilize the specific PowerShell command.