Skip to main content

How to List All Services in a Specific State (Running, Stopped) in Batch Script

Auditing the status of Windows services is a fundamental part of system health checks and security monitoring. At any given time, hundreds of services are registered on a Windows machine, some active and some dormant. Being able to filter these and generate a clean list of only "Running" or only "Stopped" services allows administrators to quickly spot anomalies, such as a crashed security agent or an unnecessary background process consuming resources.

This guide will explain how to use the sc query command to filter services by their state and how to format that output into a readable report using Batch script.

The Tool: SC QUERY STATE​

The sc (Service Control) utility has a built-in filter specifically for states. By default, sc query only shows active (running) services, but you can change this behavior using the state= parameter.

Filtering by State​

To list all services in a specific state, you use one of the following commands:

To list only Stopped services:

sc query state= inactive

To list only Running services:

sc query state= active

To list every service regardless of state:

sc query state= all
warning

The Space Requirement. Much like other sc commands, you must include a space after the equals sign (e.g., state= active). If you write state=active, the command will fail with a syntax error.

Creating a Formal Report in Batch​

The raw output of sc query is very verbose, showing service types, exit codes, and checkpoints. A better approach is to use a FOR /F loop to isolate just the "SERVICE_NAME" for a cleaner list.

Script: List Running Services (Clean Format)​

@echo off
echo --- ACTIVE WINDOWS SERVICES ---
echo.

set "Count=0"

:: Loop through 'sc' output and look for lines containing 'SERVICE_NAME'
for /f "tokens=2" %%a in ('sc query state^= active ^| findstr /c:"SERVICE_NAME"') do (
    echo [RUNNING] %%a
    set /a Count+=1
)

echo.
echo Total: %Count% running service(s^).
echo Audit Complete.
pause

Advanced Filtering: Finding Stopped Critical Services​

In a professional environment, you might only care about services that are supposed to be running but are currently stopped. You can achieve this by combining state filtering with name-based searches.

Script: Check Status of Specific Keyword Services​

@echo off
setlocal enabledelayedexpansion

set "search=MSSQL"
set "Found=0"

echo Searching for STOPPED services matching "%search%"...
echo ---------------------------------------

:: 1. Get all INACTIVE service names
:: 2. Check each one against the keyword
for /f "tokens=2" %%i in ('sc query state^= inactive ^| findstr /c:"SERVICE_NAME"') do (
    echo %%i | findstr /i "%search%" >nul
    if !errorlevel! equ 0 (
        echo [WARNING] %%i is currently NOT RUNNING.
        set "Found=1"
    )
)

if "!Found!"=="0" (
    echo [OK] No stopped services matching "%search%" were found.
)

pause
endlocal

How to Avoid Common Errors​

Wrong Way: Using TASKLIST to check services​

While tasklist /svc shows services, it only shows services that are currently running and have an active process ID. It cannot show you a list of "Stopped" services.

Correct Way: Use sc query state= .... It queries the Service Control Manager database directly, giving you the status of every registered service, even if it hasn't run since the computer was turned on.

Problem: Display Names with Spaces​

If you try to parse "DISPLAY_NAME" instead of "SERVICE_NAME", your FOR loop might break if the name contains spaces.

Solution: Use tokens=2* to ensure all words in the display name are captured.

for /f "tokens=2*" %%a in ('sc query state^= active ^| findstr /c:"DISPLAY_NAME"') do echo %%b

Best Practices and Security Rules​

1. Unique vs. Display Names​

When generating lists for other scripts to use, always output the SERVICE_NAME (e.g., wuauserv). The Display Name (e.g., Windows Update) is for humans to read, but it cannot be used reliably in follow-up commands like net start.

2. Administrator Elevation​

While viewing service lists is generally allowed for standard users, certain core system services or third-party security suites may hide their status from non-administrative accounts. Always run your service audit scripts as an Administrator for 100% accuracy.

3. Exporting to CSV​

If you need to share the list with IT support, you can easily pipe the output to a text file.

sc query state= all | findstr /c:"SERVICE_NAME" > service_inventory.txt

Real-World Use Case: The "Service Health Check"​

A script that provides a quick high-level summary of the system.

@echo off
echo --- SYSTEM SERVICE SUMMARY ---
echo Date: %date% %time%
echo.

:: Counter for running services
set "rCount=0"
for /f %%a in ('sc query state^= active ^| find /c "SERVICE_NAME"') do set "rCount=%%a"

:: Counter for stopped services
set "sCount=0"
for /f %%a in ('sc query state^= inactive ^| find /c "SERVICE_NAME"') do set "sCount=%%a"

echo Total Running: %rCount%
echo Total Stopped: %sCount%

echo.
echo Use 'sc query state= inactive' to see stopped services.
pause

Conclusions​

Listing services by state in a Batch script is a powerful way to audit a machine's environment. By leveraging the state= parameter of sc query and refining the output with findstr and FOR loops, you can transform a wall of technical text into a precise, actionable report. Whether you are hunting for missing processes or creating an inventory of active agents, these techniques provide the visibility necessary for professional system management.

Table of Contents