Important Notice: On February 29th, this community was put into read-only mode. All existing posts will remain but customers are unable to add new posts or comment on existing. Please feel to join our Community Discord for any questions and discussions.

Service Status

What is the best why to create a collection based on a service name and its status. I would like to create a group with a given service name and the status set to disabled.



Date Votes
  • Keith,

    You can to use the Service Name and Service Start Type filters and set the StartType filter to "equals disabled".  Refer to the attached screenshot.


  • I can't figure out how to do this in the latest version.  I can create a filter based on the service name but not sure how to get the state or start mode of that service.

  • I got this working in the latest version as well.  I was using service state contains "started" when I should of been using "running".

  • I have this same issue, I'm trying to create a dynamic collection of computers that have a service with the title "Windows Defender" which has the status of "Running", but it seems to evaluate each filter independently and gives me a result containing machines that have a service called "Windows Defender" and also *any* service with a status of "Running". I can't nest it so that it does what I want.



  • @Sebastian

    This gave me consistent results.  One more "All" filter does the trick. 


  • You can also use the "Any" and then the "All". I've attached a collection that shows the following (it's a quick throw together so might contain errors, but you can modify for whatever service you might need):

    • What machines have the WinDefend service (and those that don't)
    • What machines have WinDefend service Running
    • What machines have WinDefend service Stopped
    • What machines have WinDefend set to Automatic
    • What machines have WinDefend set to Disabled
    • What machines have WinDefend set to Manual

    EDIT 1/4/2016:

    I have written a KB article that covers this in quite a bit more depth: