For monitoring purposes I would like to filter out the results of the script below.

I would like to be able to specify a list of exceptions (of services) which I don't want to have in my results. This is my script.  Can anyone help me to filter these services out?

List of services I would like to filter out:

Service Portable Device Enumerator Service
Service Shell Hardware Detection
Service Office Software Protection Platform
Service WinHTTP Web Proxy Auto-Discovery Service
Service Diagnostic System Host
Service Microsoft Software Shadow Copy Provider
Service Volume Shadow Copy

My script:

# First, fetch the list of auto started services
$colItems = Get-WmiObject Win32_Service | where-object { $_.StartMode -ne 'Disabled' }
# Output the JSON header
Write-Host "{";
write-host "`t ""data"":[";
write-host

#temp variable
$temp = 1

# For each object in the list of services, print the output of the JSON message with the object properties that we are interessted in
foreach ($objItem in $colItems) {
$exe_dir = $objItem.PathName
$exe_dir = $exe_dir -replace '"?(.+\\).+exe.*','$1'
$exe_dir = $exe_dir -replace '\\','/'

$desc_val = $objItem.Description
$desc_val = $desc_val -replace '\"','@'

if ($temp -eq 0){
Write-Host ",";
}
else{
$temp = 0;
}
$line = " { `"{#SERVICESTATE}`":`"" + $objItem.State + "`", `"{#SERVICEDISPLAY}`":`"" + $objItem.DisplayName + "`", `"{#SERVICENAME}`":`"" + $objItem.Name + "`", `"{#SERVICEDESC}`":`"" + $desc_val + "`", `"{#SERVICEDIR}`":`"" + $exe_dir + "`" }"
Write-Host -NoNewline $line
}

# Close the JSON message
write-host
write-host
write-host "`t ]";
write-host "}"

Do any of the services that you want to come back start with Service, like the list you provided?

If they are, then you can modify your query like so

$colItems = Get-WMIObject Win32_Service -Filter "not StartMode='Disabled' and not Name like 'Service%'"

I did like your easy solution. However services don't start with "Service".  Corrected list below:

Portable Device Enumerator Service
Shell Hardware Detection
Office Software Protection Platform
WinHTTP Web Proxy Auto-Discovery Service
Diagnostic System Host
Microsoft Software Shadow Copy Provider
Volume Shadow Copy

Sorry for being not that clear.

It will become messy as you have to add every service display name to the filter. To shorten things up, you can query each of those services for their Name property and use that, as they tend to be short names. so like this using the Name property not the Display Name

$colItems = Get-WMIObject Win32_Service -Filter "not StartMode='Disabled' and (not Name like 'WPDBusEnum' or not Name like 'ShellHWDetection')"

Just keep appending or not Name like 'Service Name' inside the parenthesi

I tried your solution however I still receive these services in my list.

• Edited by mrbbs 10 hours 50 minutes ago

If I simplify the script to:

$colItems = Get-WMIObject Win32_Service -Filter "not StartMode='Disabled' and (not Name like 'WwanSvc')"

then the service "WwanSvc" is removed from the list.  So there must be something wrong with the "or" condition

Edit:

Ok, found the error:

"or" should be replaced by "and"

$colItems = Get-WMIObject Win32_Service -Filter "not StartMode='Disabled' and (not Name like 'WwanSvc' and not

Name like 'wudfsvc')"

Thanks for helping me out clayman2!

• Edited by mrbbs 10 hours 48 minutes ago

For monitoring purposes I would like to filter out the results of the script below.

I would like to be able to specify a list of exceptions (of services) which I don't want to have in my results. This is my script.  Can anyone help me to filter these services out?

List of services I would like to filter out:

Service Portable Device Enumerator Service
Service Shell Hardware Detection
Service Office Software Protection Platform
Service WinHTTP Web Proxy Auto-Discovery Service
Service Diagnostic System Host
Service Microsoft Software Shadow Copy Provider
Service Volume Shadow Copy

...

$colItems = Get-WmiObject Win32_Service | where-object { $_.StartMode -ne 'Disabled' }

Simple:

#Requires -Version 4

$1='Service Portable Device Enumerator Service'
# all other services to exclude
$7='Service Volume Shadow Copy'

$exclude=$1,$2,$3,$4,$5,$6,$7

gcim win32_service -filter "not startmode = 'disabled'" | 
    ? displayname -notin $exclude | 
    ft displayname

# notice, I'm using gcim instead of gwmi.

I tried your solution however I still receive these services in my list.

• Edited by mrbbs Wednesday, May 20, 2015 8:19 PM

If I simplify the script to:

$colItems = Get-WMIObject Win32_Service -Filter "not StartMode='Disabled' and (not Name like 'WwanSvc')"

then the service "WwanSvc" is removed from the list.  So there must be something wrong with the "or" condition

Edit:

Ok, found the error:

"or" should be replaced by "and"

$colItems = Get-WMIObject Win32_Service -Filter "not StartMode='Disabled' and (not Name like 'WwanSvc' and not

Name like 'wudfsvc')"

Thanks for helping me out clayman2!

• Edited by mrbbs Wednesday, May 20, 2015 8:21 PM