(imported comment written by NoahSalzman)
You were close. Here’s a bunch of examples:
q: service “W32Time”
A: “W32Time” “Windows Time” “Running”
T: 0.150 ms
q: services whose (display name of it as string contains “Windows”)
A: “AudioEndpointBuilder” “Windows Audio Endpoint Builder” “Stopped”
A: “Audiosrv” “Windows Audio” “Stopped”
A: “EventLog” “Windows Event Log” “Running”
A: “FontCache” “Windows Font Cache Service” “Running”
A: “FontCache3.0.0.0” “Windows Presentation Foundation Font Cache 3.0.0.0” “Stopped”
A: “idsvc” “Windows CardSpace” “Stopped”
A: “MpsSvc” “Windows Firewall” “Running”
A: “msiserver” “Windows Installer” “Stopped”
A: “TrustedInstaller” “Windows Modules Installer” “Stopped”
A: “W32Time” “Windows Time” “Running”
A: “WcsPlugInService” “Windows Color System” “Stopped”
A: “Wecsvc” “Windows Event Collector” “Stopped”
A: “WerSvc” “Windows Error Reporting Service” “Running”
A: “Winmgmt” “Windows Management Instrumentation” “Running”
A: “WinRM” “Windows Remote Management (WS-Management)” “Running”
A: “wuauserv” “Windows Update” “Running”
A: “wudfsvc” “Windows Driver Foundation - User-mode Driver Framework” “Stopped”
T: 0.261 ms
q: (display name of it, start type of it, state of it, running of it) of services whose (display name of it is “Windows Time”)
A: Windows Time, auto, Running, True
T: 72.405 ms
q: properties whose (it as string contains “”)
A: service name of : string
A: display name of : string
A: state of : string
A: can interact with desktop of : boolean
A: win32 exit code of : integer
A: service specific exit code of : integer
A: checkpoint of : integer
A: login account of : string
A: start type of : string
A: image path of : string
A: file of : file
A: version of : version
A: win32 type of : boolean
A: driver type of : boolean
A: running of : boolean
A: security descriptor of : security descriptor