Windows Services tracker

Question

Sometimes, I need to hunt down what changed in my Windows Services (more specifically, what errant idiot of a program (or in worse case, malware) installed a new automatically-started service that is eating up resources.

I'm looking for a program that lets me:

1. Take a "snapshot" of which services are in Automatic/Manual/Disabled mode.
2. Compare it with previous "snapshot".

I'm mostly interested in Step 1: if the program is able to take a snapshot, and export it to some file easily parsable or diff-able, I can do #2 in Perl/shell/whatnot myself easily. Of course if the program does both #1/#2 for me, that's fine.

No need for ability to run on a schedule/daemon or monitor for changes. Just export when I want.

MUST work on Windows XP, but would preferably work on Win7 and Win8 assuming they still retain the concept of Services.

I'm OK with a compiled program, OR PowerShell script (or Python or Perl)

Answer 1

To take a snapshot of which services are in Automatic/Manual/Disabled mode, you can simply do:

The exported list is a column-separated values that includes the Startup Type:

Name    Description Status      Startup Type    Log On As
ActiveX Installer (AxInstSV)    Provides User Account Control validation for the installation of ActiveX controls from the Internet and enables management of ActiveX control installation based on Group Policy settings. This service is started on demand and if disabled the installation of ActiveX controls will behave according to default browser settings.        Manual  Local System
Adaptive Brightness Monitors ambient light sensors to detect changes in ambient light and adjust the display brightness.  If this service is stopped or disabled, the display brightness will not adapt to lighting conditions.     Manual  Local Service
Adobe Acrobat Update Service    Adobe Acrobat Updater keeps your Adobe software up to date. Started Automatic   Local System
Application Experience  Processes application compatibility cache requests for applications as they are launched        Manual  Local System
Application Identity    Determines and verifies the identity of an application. Disabling this service will prevent AppLocker from being enforced.      Manual  Local Service

Unfortunately you'll have to diff yourself (should be pretty easy though).

Answer 2

There is another solution. You do not need to maintain and compare those snapshots by yourself. 10-Strike Network Inventory Explorer can scan the inventory data (services) on network computers and track found changes. You can choose configuration items for tracking (services in your case and/or something else like startup shortcuts) and the tracking time period (for example, 1 hour or 3 days). The program will scan the data using WMI in the automatic background mode, compare snapshots, detect changes, and send reports to your email.