Link to home
Start Free TrialLog in
Avatar of bsharath
bsharathFlag for India

asked on

Find if the particular service is Automatic and started

Hi Experts,

I need to find if all the machines on the network are enabled with
1.Task scheduler
2.Sophos Antivirus
3.Remote registry

Please give me a tool or code to help me do this task.

regards
Sharath
Avatar of younghv
younghv
Flag of United States of America image

Hi Sharath,
If you still have access to the 'Hyena' Program, you can do an 'export' of each of those services to cover your entire network.

Vic
Avatar of bsharath

ASKER

Younghv
I have the software can you tell me how i can do this.

THX
Sharath
Younghv

Any updates....
ASKER CERTIFIED SOLUTION
Avatar of sirbounty
sirbounty
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
S & S,
Sorry, I've been out on a job.

The 'Export' function of Hyena is a tool built into the Menu at the top of the screen when Hyena is open.
When you 'Export' you need two things:
1. The ACTUAL name of the service (w32time, wuauserv, etc) - put the actual service name where asked.
2. The ACTUAL location and type of file you want the report to be (C:\TimeService.txt).

When you cycle through the tabs in the Export window, you will have to check the function you want it to run (Services, Users, Computers, etc.).

Just do one function at a time. I will do multiple functions, but I've always found it better to keep it simple.

I'll be on for another hour or so, then back to making money.

Vic
Sirbounty

I get this error please help

C:\>cscript a.vbs
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

C:\a.vbs(2, 5) Microsoft VBScript compilation error: Expected identifier
Huh?  Where'd you get a vbscript from this? : \
Sorry sirbounty

I saved it as a vbs file

Now this works i have saved it to a bat file.

I get this result what does this mean

dev-chen-pc100
---------
Scheduler status:
        STATE              : 4  RUNNING
Remote Registry status:  
        STATE              : 4  RUNNING
The State 'running' lets you know the service is running...is that not what you wanted? (apolgies if I misread something).
I got confused as it shows 4 RUNNING.
4 is apparently just the 'code' for the state, we can weed that out...

Heres the condensed version...

@echo off
for /f %%a in (C:\Computers.txt) do call :process %%a
goto :eof

:process
set PC=%1
for %%s in (schedule BITS remoteregistry) do (
  for /f "tokens=4" %%x in ('sc \\%pc% query %%s^|find /i "state"') do echo Service %%s on %PC% is %%x >> C:\Results.log
)

I used BITS above, but you can use sophos, if you have the service name...
Happy to help - thanx for the grade! :^ )
Sirbounty.

I know that the question is closed but need one more help.

The service name for Sophos are.

Sophos Agent
Sophos Anti-Virus
Sophos Anti-Virus status reporter
Sophos AutoUpdate Service
Sophos Message Router

Can you do a script for all these services.
Please let me know if you need any info.
Is it possible to start the service if it is stopped automatically done remotely.

Regards
Sharath

Double-click each of those in the services applet - they should have an image name listed (that appears to be the 'descriptive' name).

Gather up those and it can probably be easily adjusted to include them...
HERE ARE THE DETAILS

Sophos Agent(Management Agent for Sophos applications)
SOPHOS ANTIVIRUS (Performs threat scanning and cleanup functions.)
Sohos antivirus statu reporter (Provides information to Windows Security Center on whether Sophos Anti-Virus is up to date and whether on-access scanning is enabled.)
Sophos AutoUpdate Service(Part of the updating system for Sophos components)
Sorry the other one is

Sophos Message Router (Message router for Sophos applications)
Still looks like description/details...
Try this from a command prompt:

sc query | find /i "sophos" > c:\sophos.txt

Post sophos.txt here (or upload it to www.ee-stuff.com)
I get this


ERROR, Invalid Option
DESCRIPTION:
        SC is a command line program used for communicating with the
        NT Service Controller and services.
USAGE:
        sc <server> [command] [service name] <option1> <option2>...

        The option <server> has the form "\\ServerName"
        Further help on commands can be obtained by typing: "sc [command]"
        Commands:
          query-----------Queries the status for a service, or
                          enumerates the status for types of services.
          queryex---------Queries the extended status for a service, or
                          enumerates the status for types of services.
          start-----------Starts a service.
          pause-----------Sends a PAUSE control request to a service.
          interrogate-----Sends an INTERROGATE control request to a service.
          continue--------Sends a CONTINUE control request to a service.
          stop------------Sends a STOP request to a service.
          config----------Changes the configuration of a service (persistant).
          description-----Changes the description of a service.
          failure---------Changes the actions taken by a service upon failure.
          qc--------------Queries the configuration information for a service.
          qdescription----Queries the description for a service.
          qfailure--------Queries the actions taken by a service upon failure.
          delete----------Deletes a service (from the registry).
          create----------Creates a service. (adds it to the registry).
          control---------Sends a control to a service.
          sdshow----------Displays a service's security descriptor.
          sdset-----------Sets a service's security descriptor.
          GetDisplayName--Gets the DisplayName for a service.
          GetKeyName------Gets the ServiceKeyName for a service.
          EnumDepend------Enumerates Service Dependencies.

        The following commands don't require a service name:
        sc <server> <command> <option>
          boot------------(ok | bad) Indicates whether the last boot should
                          be saved as the last-known-good boot configuration
          Lock------------Locks the Service Database
          QueryLock-------Queries the LockStatus for the SCManager Database
EXAMPLE:
        sc start MyService

Would you like to see help for the QUERY and QUERYEX commands? [ y | n ]:
Hmm - not sure why that's not working...

Hope you're comfortable in the registry?

Start->Run->Regedit
Navigate to HKLM\System\CurrentControlSet\Services
<Ctrl> + F
will initiate a 'find'.  Search for sophos - or simply navigate through the Services listed - presumably just hit "S" to get to the "S"-named services.
Locate the sophos services above - I'll need the info in each key's imagepath setting (not the path, just the exe name)