Get windows service failure action value

Question

Need to get the failure actions set for the service. the below PS query giving the vague value

get-itemproperty hklm:\system\currentcontrolset\services\<ServiceName> | select -Expand FailureActions

I need to get the value for 'First failure', 'Second failure' and 'Subsequent failure' field value.

The result for the above PS query is like

When I am changing the value the line number 21, 29 and 37 getting changed but not sure whether we need to refer the mentioned lines only. And also please help me to get the idea of other values in the result set. — Venkatesh R, Jun 13 '19 at 06:20
Append this code to get non-zero values "| Where-Object { $_ -ne "0" }" — Nirav Mistry, Jun 13 '19 at 06:22
@RanadipDutta, Need to get the value of 'First failure', 'Second failure' and 'Subsequent failure' field values in Recovery tab in service property window — Venkatesh R, Jun 13 '19 at 07:27
See: https://stackoverflow.com/questions/36462623/what-reg-binary-to-set-for-failureaction-for-service — mhu, Jun 13 '19 at 07:30

score 1 · Answer 1 · answered Jun 13 '19 at 08:07

Based on the excellent answer here: What REG-BINARY to set for FailureAction for service, here is one option:

function Get-ServiceRecovery {

    Param($ServiceName)

    $failureActions = (Get-ItemProperty hklm:\system\currentcontrolset\services\$ServiceName).FailureActions

    $possibleActions = 'NoAction', 'RestartService','RestartComputer','RunProgram'

    [PsCustomObject]@{
        Service           = $ServiceName
        FirstFailure      = $possibleActions[$failureActions[20]]
        SecondFailure     = $possibleActions[$failureActions[28]]
        SubsequentFailure = $possibleActions[$failureActions[36]]
    }

}

So, calling like this: Get-ServiceRecovery -ServiceName 'W32Time' gives output like this:

Service FirstFailure   SecondFailure  SubsequentFailure
------- ------------   -------------  -----------------
W32Time RestartService RestartService NoAction

Pieter Vermeersch · Answer 2 · 2022-03-23T13:15:03.890

I needed this today but I also needed the delay times.

Based on the linked answer I was able to extend boxdog's answer and add them as well:

function Get-ServiceRecovery {

    Param($ServiceName)

    $failureActions = (Get-ItemProperty hklm:\system\currentcontrolset\services\$ServiceName).FailureActions

    $possibleActions = 'NoAction', 'RestartService','RestartComputer','RunProgram'

    [PsCustomObject]@{
        Service            = $ServiceName
        FirstFailure       = $possibleActions[$failureActions[20]]
        FirstDelayMs       = Get-Delay -ByteArray $failureActions[24..27]
        SecondFailure      = $possibleActions[$failureActions[28]]
        SecondDelayMs      = Get-Delay -ByteArray $failureActions[32..35]
        SubsequentFailure  = $possibleActions[$failureActions[36]]
        SubsequentDelayMs  = Get-Delay -ByteArray $failureActions[40..43]
        ResetDelayS        = Get-Delay -ByteArray $failureActions[0..3]
    }
}

function Get-Delay {
    Param($ByteArray)

    $binary = "";

    for ($i=$ByteArray.Length-1; $i -ge 0; $i--) {
        $binary += Convert-To8BitBinary -byte $ByteArray[$i]
    }

    return Convert-ToDecimal -binary $binary
}

function Convert-To8BitBinary {
    Param($byte)
    return ([string][convert]::ToString($byte, 2)).PadLeft(8, '0')
}

function Convert-ToDecimal {
    Param($binary)
    return ([string][convert]::ToInt32($binary, 2))
}

Get-ServiceRecovery -ServiceName $serviceName

Now, calling like this: Get-ServiceRecovery -ServiceName 'W32Time' gives output like this:

Service           : W32Time
FirstFailure      : RestartService
FirstDelayMs      : 60000
SecondFailure     : RestartService
SecondDelayMs     : 120000
SubsequentFailure : NoAction
SubsequentDelayMs : 0
ResetDelayS       : 86400

score 0 · Answer 3 · answered Aug 30 '22 at 16:30

For a more comprehensive solution, jborean93 has created a custom type that exposes the native C# service objects and methods to PowerShell. The included Get-ServiceRecovery and Set-ServiceRecovery functions make it easy to view and change service recovery settings within PowerShell. https://gist.github.com/jborean93/889288b56087a2c5def7fa49b6a8a0ad

.\ServiceRecovery.ps1
(Get-ServiceRecovery -Name 'MyService').Actions #Display failure actions
Set-ServiceRecovery -Name 'MyService' -Actions @('RunCommand', 'Restart', 'None') -Command '"C:\Windows\System32\cmd.exe" /c echo hi'

For the DSC fans out there, looks like this functionality is also being worked into xPSDesiredStateConfiguration (xService) at some point in the future. https://github.com/dsccommunity/xPSDesiredStateConfiguration/pull/679

Get windows service failure action value

3 Answers3

Linked