Tanium Sensor: Parameterized Service State & Start Mode

This page documents the Parameterized Tanium Sensor: Service State & Start Mode, which allows operators to query the status and startup mode of any Windows service by providing a service name as an input parameter.

Overview

This parameterized sensor enables Tanium users to:

• Specify a service name at query time.

• Retrieve both the current state (Running, Stopped, Paused, etc.) and the start mode (Automatic, Manual, Disabled) of the service.

• Validate the configuration and health of endpoint services.

Parameters

• ServiceName — The name of the Windows service to query.

The parameter token ||ServiceName|| allows Tanium to inject user-supplied values when the sensor is executed.

Example Tanium Usage

In Interact, users would enter:

Example output:

Script Code

# Parameterized Tanium Sensor: Service State & Start Mode

# Declare parameters so Tanium knows they are used
$parameters = @("||ServiceName||")

# Tanium will substitute the user's input into this token
$svcName = "||ServiceName||"

if ([string]::IsNullOrWhiteSpace($svcName)) {
    Write-Host "No service specified"
    exit
}

try {
    # Use Win32_Service for richer metadata
    $svc = Get-WmiObject -Class Win32_Service -Filter "Name='$svcName'" -ErrorAction Stop
}
catch {
    Write-Host "Service not found"
    exit
}

if (-not $svc) {
    Write-Host "Service not found"
    exit
}

# Output both State and StartMode (space-delimited or pipe-delimited)
Write-Host "$($svc.State) | $($svc.StartMode)"

Output Format

The sensor returns:

Examples:

• Running | Auto

• Stopped | Manual

• Stopped | Disabled

Common Use Cases

• Verifying critical service health.

• Validating compliance with required service configurations.

• Performing mass service audits in troubleshooting scenarios.

• Quickly determining which endpoints have misconfigured or disabled services.

Notes

• Uses Win32_Service instead of Get-Service to retrieve richer metadata (e.g., StartMode).

• If the service does not exist, it returns Service not found.

• Supports any Windows service name compliant with Win32_Service.Name.