Windows Server Hack [Electronic resources] نسخه متنی

Hack 36 Manage Services on Remote Machines

Here are three handy scripts for managing
network services that run on remote machines.

While the Services node in Computer Management can be
used to manage services on remote machines, using a script is easier
if you have many systems to manage. This hack offers three VB scripts
you can use to display the services that run on a remote computer,
change the start mode for a service, and change the password for the
account used by a service. Enjoy!

Getting Remote Computer Service Information

If you want to check services on a remote computer, VBScript can
help. Using the WMI repository and ADSI, you can easily retrieve
information on stopped or started services.

The script prompts for the NetBIOS name of the remote computer.
Alternatively, you can get the service information for the local
computer by typing in the local name as localhost.
The script responds by displaying complete information for the
services that are registered on the specified computer.

The code

Type the following script into Notepad (with Word Wrap disabled) and
save it with a .vbs extension:

ComputerName = InputBox("Enter the name of the computer for which you " & _
"want service information")
winmgmt1 = "winmgmts:{impersonationLevel=impersonate}!//"& ComputerName &"
Set ServSet = GetObject( winmgmt1 ).InstancesOf ("Win32_service")
for each Serv in ServSet
GetObject("winmgmts:").InstancesOf ("win32_service")
WScript.Echo "
WScript.Echo Serv.Description
WScript.Echo " Executable: ", Serv.PathName
WScript.Echo " Status: ", Serv.Status
WScript.Echo " State: ", Serv.State
WScript.Echo " Start Mode: ", Serv.StartMode
Wscript.Echo " Start Name: ", Serv.StartName
next

Running the hack

To run the script, open a command prompt, switch to the directory
where the script is located, and type the following:

cscript.exe GetRemoteServices.vbs > services.txt

The reason for redirecting output to a text file is because the
script generates a lot of output. A dialog box appears (see Figure 4-1), requesting the name of the remote machine.
The machine name can be a FQDN, NetBIOS name, or IP address, as
desired.

Figure 4-1. Getting information about services running on a remote machine

Here's a sample of what the output of the script
might look like if the target machine is running Windows Server 2003:

Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.
Notifies selected users and computers of administrative alerts. If the service is stopped,
programs that use administrative alerts will not receive them. If this service is 
disabled,
any services that explicitly depend on it will fail to start.
Executable:  C:\WINDOWS\system32\svchost.exe -k LocalService
Status:  OK
State:  Stopped
Start Mode:  Disabled
Start Name:  NT AUTHORITY\LocalService
Provides support for application level protocol plug-ins and enables network/protocol 
connectivity. If this service is disabled, any services that explicitly depend on it will 
fail to start.
Executable:  C:\WINDOWS\System32\alg.exe
Status:  OK
State:  Stopped
Start Mode:  Manual
Start Name:  NT AUTHORITY\LocalService
Processes installation, removal, and enumeration requests for Active Directory
IntelliMirror group policy programs. If the service is disabled, users will be unable to 
install, remove, or enumerate any IntelliMirror programs. If this service is disabled, 
any services that explicitly depend on it will fail to start.
Executable:  C:\WINDOWS\system32\svchost.exe -k netsvcs
Status:  OK
State:  Stopped
Start Mode:  Manual
Start Name:  LocalSystem

Note that you can easily determine the start mode, service account,
and state of each service from this output.

Changing the Start Mode for a Service

This VBScript changes the Server service start mode to Automatic and
works remotely. This can be a big help to sites where the security
folks have gone nuts and disabled the Server service or set it to
Manual start mode.

In its current form, the script prompts for a remote computer name,
connects, and changes the Server service's start
mode. The script could also be edited to run on the local computer
and placed in a login script to hit a large number of computers at
once.

The code

Type the following script into Notepad (with Word Wrap disabled) and
save it with a .vbs extension:

strComputer = InputBox("Enter the name of the computer for which " & _
"you want to change the Start Mode for the Server service")
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colService = objWMIService.ExecQuery _
("Select * from Win32_Service where DisplayName = 'Server'")
For Each objService in colService
errReturnCode = objService.Change( , , , , "Automatic") 
Next

Running the hack

To run this script, simply create a shortcut to it and double-click
on the shortcut.

To change the start mode of another service, simply change the
DisplayName to the service you want to modify. For
example, to change the start mode for the World Wide Web Publishing
Service, you'd alter the select statement to read:

("Select * from Win32_Service where DisplayName = 'w3svc'").

And, of course, you can also use "Manual" or
"Disabled" instead of
"Automatic" in the second-to-last line.

Changing a Service Password

Services always run within the context of some user account. Usually,
this account is built in, such as LocalSystem or
NetworkService, but some services, such as IIS and
those for Exchange, use special accounts called service
accounts. To ensure these accounts are secure, you can
change the password used by these accounts, which this script will
allow you to do.

The code

Type the following script into Notepad (with Word Wrap disabled) and
save it with a .vbs extension:

Dim Computer
Dim ComputerName
Dim ComputerDomain
Dim Service
Dim TargetService
Dim NewPassword
TargetService = "YourServicename"
ComputerDomain = "YourDomain"
ComputerName = "YourComputerName"
NewPassword = "YourPassword"
Set Computer = GetObject("WinNT://" & ComputerDomain & "/" & ComputerName & _ ",computer"
Set Service = Computer.GetObject("service", TargetService)
Service.SetPassword(NewPassword)
Service.SetInfo

Running the hack

Just replace the items in the following lines with
your own information:

TargetService = "YourServicename"
ComputerDomain = "YourDomain"
ComputerName = "YourComputerName"
NewPassword = "YourPassword"

For example:

TargetService = "Network Agent"
ComputerDomain = "MTIT"
ComputerName = "SRV14"
NewPassword = "Pa$$w0rd"

Rod Trent