Question

Anyone have a nifty trick (in Python) to detect Windows services that are configured with a Startup Type of “Automatic (Delayed Start)”?

I thought WMI would be the way to go, but services configured as “Automatic” and “Automatic (Delayed Start)” both show up with a StartMode of “Auto”.

For example, on my local Windows 7 box using Services.msc I see that “Windows Update” is configured for “Automatic (Delayed Start)” yet WMI simply shows as “Auto”:

>>> c = wmi.WMI()
>>> local = c.Win32_Service(Caption='Windows Update')
>>> len(local)
1
>>> print local[0]

instance of Win32_Service
{
        AcceptPause = FALSE;
        AcceptStop = TRUE;
        Caption = "Windows Update";
        CheckPoint = 0;
        CreationClassName = "Win32_Service";
        Description = "Enables the... <cut for brevity> ...(WUA) API.";
        DesktopInteract = FALSE;
        DisplayName = "Windows Update";
        ErrorControl = "Normal";
        ExitCode = 0;
        Name = "wuauserv";
        PathName = "C:\\Windows\\system32\\svchost.exe -k netsvcs";
        ProcessId = 128;
        ServiceSpecificExitCode = 0;
        ServiceType = "Share Process";
        Started = TRUE;
        StartMode = "Auto";
        StartName = "LocalSystem";
        State = "Running";
        Status = "OK";
        SystemCreationClassName = "Win32_ComputerSystem";
        SystemName = "MEMYSELFANDI";
        TagId = 0;
        WaitHint = 0;
};

>>> local[0].StartMode
u'Auto'

I welcome any suggestions.

Cheers,
Rob

Answer 1

As @RRUZ mentioned, delayed autostart isn’t exposed through WMI. Here’s some sample code for the registry query.

from _winreg import OpenKey, QueryValueEx, HKEY_LOCAL_MACHINE

# assume delayed autostart isn't set
delayed = False

# registry key to query
key = OpenKey(HKEY_LOCAL_MACHINE, 'SYSTEM\CurrentControlSet\services\wuauserv')
try:
    delayed = bool(QueryValueEx(key, 'DelayedAutoStart')[0])
except WindowsError, e:
    print 'Error querying DelayedAutoStart key: {0}'.format(e)

print delayed