Find stopped automatic services
Documentation: Microsoft Learn
Use Get-Service and Where-Object to find automatic-start services that are not running. Return service names and display names for investigation.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
See the objects move
Inspect this authored example with fictional data in the bounded browser model. The numbered stages show how its objects change.
Get-Service | Where-Object StartType -eq Automatic | Where-Object Status -ne Running | Select-Object Name,DisplayName,Status,StartType- Stage 1Get-Service
Positional values or no named parameters - Stage 2Where-Object
-eq - Stage 3Where-Object
-ne - Stage 4Select-Object
Positional values or no named parameters
Walk through the pipeline
Select a stage to see why it exists and what objects it passes forward.
Get-Service returns service objects with properties such as Name, Status and StartType. Nothing has been converted to text.
How it works
Get-Service returns every service controller on the machine. The first Where-Object keeps entries whose StartType is Automatic, the second drops anything already Running, and Select-Object reports the short service name next to its display name so the result reads without a second lookup.
Adapting it
Append a third filter that excludes known-benign names once you have seen the baseline output on a healthy host. Changing Automatic to Manual turns this into a hunt for trigger-start services that should have fired and did not.
If the result is unexpected
The list is full of services nobody expected to be running, or a service known to be stopped is missing from it altogether.
Delayed-start services report a StartType of plain Automatic, so they fill this list for the first minutes after boot with nothing wrong. Trigger-start services report Manual and sit stopped legitimately until their trigger fires. On PowerShell versions before 5.0 the Get-Service object has no StartType at all, and the filter then matches nothing at all.
- Check $PSVersionTable, because StartType arrived on the Get-Service object in PowerShell 5.0 and the filter silently matches nothing without it.
- Read the real configuration from Win32_Service, which exposes DelayedAutoStart as its own field.
- Compare the machine's uptime against the list, since a recent boot accounts for most of it.
- Search the System log for service start failures around boot time to separate a failure from a delay.
- Run sc.exe qtriggerinfo against anything reporting Manual that you expected to be up.
Validate the result
Rerunning several minutes after boot returns only services whose System log entries show a genuine start failure.
Keep the check reliable
Filter on DelayedAutoStart from the CIM class rather than the simplified StartType, and require a minimum uptime before the report runs at all.
Primary documentation
Practise the script’s building blocks
Find stopped automatic services
Return Name and StartType for stopped services with StartType Automatic.
The sandbox is visible now. Sign in with Google only when you run or check a task; commands and temporary files are discarded when you leave.
Run a command to inspect its result.
