How to Find the Installation Path of a Windows Service using PowerShell

Hunting Down Rogue Services

When auditing a Windows Server for security vulnerabilities, system administrators frequently encounter vaguely named, undocumented services running in the background (e.g., “UpdateService” or “MonitorAgent”). Before you decide to stop or delete the service, you must determine exactly which software package installed it and where the executable binary (the .exe file) is located on the hard drive.

While you can open the services.msc GUI, double-click the service, and look at the “Path to executable” text box, PowerShell allows you to query this information instantly, making it perfect for automated security auditing scripts.

The Limitation of Get-Service

The standard PowerShell cmdlet for interacting with services is Get-Service. However, this cmdlet is surprisingly limited. If you run Get-Service -Name "Spooler", it will tell you the status (Running or Stopped) and the Display Name, but it will not return the installation path.

Using WMI to Find the Path

To extract the detailed installation path, you must query the Windows Management Instrumentation (WMI) database directly using the Win32_Service class.

Open an elevated PowerShell prompt and execute the following command (replacing “Spooler” with the exact name of the service you are investigating):

Get-WmiObject Win32_Service -Filter "Name='Spooler'" | Select-Object Name, PathName

The output will clearly display the absolute path to the executable driving the service:

Name    PathName
----    --------
Spooler C:\Windows\System32\spoolsv.exe

Handling Services with Spaces

If the service name contains spaces (which is common for third-party software), you must ensure the WMI filter is formatted correctly with single quotes nested inside double quotes.

Get-WmiObject Win32_Service -Filter "Name='Google Update Service (gupdate)'" | Select-Object PathName

Exporting Paths for All Services

If you are conducting a full security audit of a compromised server and want to review the file paths of every single service currently running on the machine, you can omit the filter and export the entire dataset to a CSV file.

Get-WmiObject Win32_Service | Where-Object {$_.State -eq 'Running'} | Select-Object Name, DisplayName, PathName | Export-Csv -Path "C:\Temp\RunningServices.csv" -NoTypeInformation

By opening the resulting spreadsheet, you can quickly scan the PathName column. If you spot a service running from C:\Users\Public\Downloads\update.exe instead of the protected C:\Program Files\ directory, you have likely identified a malicious payload.