Monday, June 10, 2013

[ C# ] - Retrieve List of Stopped Service using WMI Query

 1. Introduction

What is WMI? WMI stands for "Windows Management Instrumentation". WMI is set of classes living in a separate world of dot net framework in form of wrapper classes around set of native classes that retrieves hardware information. Say for Example, if I want to retrieve the information like remaining battery in my laptop when it is off the power source. The dotnet framework may not support getting this kind of information but the WMI will. To know list of WMI classes, do a google search for “WMI Classes”. When open the link coming from MSDN (Article written in 2013) the left side pane consists of all WMI classes in groups like Win32 Classes, WMI System classes, etc The MSDN link is shown below:

Figure 1

In this Article we will create a simple example that will Query the all the System Services which is in the stopped state.

2. Starting the Project

We are going to display the List of stopped service in a console window. So, create a Visual C# Console Application. Once the IDE gives you generated code, the first thing we should do is, bring WMI environment to our project.

To access the WMI classes we need to use the "System.Management.dll". Right click you project and using the Add Reference and add the Reference to System.Management as shown in the below given picture. This reference will appear under the reference node of the project.

Figure 2

1) Select the .Net Tab
2) Pick the Assembly
3) Click OK

3. Start Coding – Column Formatted Console Output

1) Add the using directive for easy access of the "WMI Classes" in the program main.

//Sample 01: Required Name Space for the WMI Query
using System.Management;

2) From the Win32_Service class we are going to take three coumns called Name, StartMode, State. "Name" is the service name. "StartMode" will tell the service start type like Manual or Automatic etc. The "State" column tells at what state the service is. How do I know all these information? The Class Win32_Servie Information is taken from the MSDN As shown below:
Figure 3

Right! We are going to take three columns and will display that in the console window. The function written below will keep each of the columns at certain location in the console output window.

//Sample 02: Function that Provides the Padded column Output
public static void PrintColumnData(string Column1, string Column2, string Column3)
    Console.CursorLeft = 0;
    Console.CursorLeft = 40;
    Console.CursorLeft = 55;

We can use the above function to start each column at specific localtion as shown in the below depiction. To set the caret at a specific column location in the console output the CursorLeft property is used. OK, now we will concentrate on retrieving the stopped services.
Figure 4

4. The ManagementObjectCollection

Go back and Look at Figure 3, from that you can know that class name is Win32_Service and class data member that we want to retrieve are Name, StartMode, State.  Also note that we want to retrieve only the stopped services. The state member of the class tells us whether the service is stopped or not. The screen taken from the MSDN for possible values of State is shown in Figure 5:

Figure 5

WMI supports query based retrieval of the information that we are looking for. You can map the information given by MSDN in Figure 3 with a database table and form a Query for information retrieval. The mapping between WMI Class and Database Table is shown in Figure 6 by taking the Win32_Service class as an example.

Figure 6

OK. Now you have the understanding of the mapping. We use "SelectQuery" to form the WMI Query. The SelectQuery object created on the "WMI Win32_Service Class" using the above mapping technique is given in the below code snippet:

//Sample 03: First form the Select Query
SelectQuery Qry = new SelectQuery("Select Name, " +
    "StartMode, State From Win32_Service " +
    "Where State = 'Stopped'");

Using this SelectQuery object Qry, a searcher object of type "ManagementObjectSearcher" is created. The searcher object is useful to retrieve the collection of the "ManagementObject" based on the supplied query. The Get() methods will give the collection. As the Query is against the Win32_Service with the where condition asking for the service in stopped state, the Get() method of the searcher instance will do the search in WMI object pool and picks the required objects then packs that in the "ManagementObjectCollection". Below is the code:

//Sample 04: Create the Object_Search Instance. The Instance
//           Will search and bring the Object based on Supplied
//           Query
ManagementObjectSearcher searcher = new ManagementObjectSearcher(Qry);

//Sample 05: Use the searcher object to get List f Stopped
//           Service from the Win32_Service Class
ManagementObjectCollection services_stopped = searcher.Get();

5. List the Windows Services

The ManagementObjectCollection is collection of ManagementObject. Now have a look at Figure 6, ManagementObjectCollection is records returned or you can consider that as table. ManagementObject can be seen as single record. And we get the columns from this single record. In the below code we are iterating through the Collection service_stopped and display each column of the single WMI instance using the notation WMIInstance[<Field Name>] for example mobj[“StartMode”]. Below is code that retrieves the required columns and displays that using the PrintColumnData explained in section 3 of this article.

//Sample 06: Iterate through the collection and display the stopped
//           Services.
PrintColumnData("Service Name", "Start Mode", "Status");
PrintColumnData("============", "===========", "======");
foreach (ManagementObject mobj in services_stopped)
    PrintColumnData(mobj["Name"].ToString(), mobj["StartMode"].ToString(), mobj["State"].ToString());

The output of the program is shown below:

Figure 7

Source Code : Download


Leave your comment(s) here.

Like this site? Tell it to your Firend :)