PowerShell: Query Windows Service Start Time

If you are windows administrator, you often come across a requirement to know when a service is started. The most obvious way is to drill through the event log and fetch this information. For this either you need to login to server interactively or verify event viewer remotely. Working interactively or via Event Viewer MMC is a painful process especially if the remote server is located in a remote place with high latency wan connection. I too came across similar situation and felt I should have somewhat easy to get this information. I quickly explored Win32_Service WMI class but I couldn’t find this service start information in any of the attributes/methods. After spending sometime, I came across a “PowerShell Guy” article which took me in right direction. The approach the author used in that post is very simple. Just get the PID of the process and get the process creation time which has that PID. It is matter of just two WMI calls. I found it is easy method and wrote the below script.

[cmdletbinding()]            

param (
 [parameter(ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)]
 [string[]]$ComputerName = $env:computername,            

 [ValidateNotNullOrEmpty()]
 [Alias("ServiceName")]
 [string]$Name            

)            

begin{}            

Process {            

 foreach ($Computer in $ComputerName) {
  if(Test-Connection -ComputerName $Computer -Count 1 -ea 0) {
   Write-Verbose "$Computer is online"
   $Service = Get-WmiObject -Class Win32_Service -ComputerName $Computer -Filter "Name='$Name'" -ea 0
   if($Service) {
    $ServicePID = $Service.ProcessID
    $ProcessInfo = Get-WmiObject -Class Win32_Process -ComputerName $Computer -Filter "ProcessID='$ServicePID'" -ea 0
    $OutputObj  = New-Object -Type PSObject
    $OutputObj | Add-Member -MemberType NoteProperty -Name ComputerName -Value $Computer.ToUpper()
    $OutputObj | Add-Member -MemberType NoteProperty -Name Name -Value $Name
    $OutputObj | Add-Member -MemberType NoteProperty -Name DisplayName -Value $Service.DisplayName
    $OutputObj | Add-Member -MemberType NoteProperty -Name StartTime -Value $($Service.ConvertToDateTime($ProcessInfo.CreationDate))
    $OutputObj
   } else {
    write-verbose "Service `($Name`) not found on $Computer"
   }
  } else {
   write-Verbose "$Computer is offline"
  }
 }            

}            

end {}

Usage examples:

.\Get-ServiceStartTime.ps1 -ComputerName “mytestpc1” -Name spooler

.\Get-ServiceStartTime.ps1 -ComputerName “mytestpc1”, “mytestpc2” -Name spooler

Hope this helps.