I'm looking for a robust way to determine if a service can be stopped without data loss or corruption, or if a regular stopping will work if the service can be killed via powershell.
I thought about to watch the file handles for the service to see if the service is writing or reading something from there working directory. Is there something else I can query via powershell to see if the service is still processing data.
The most "robust" way of determining whether a service can be stopped or killed is to analyze its source code to see if it handles a shutdown or stop event properly.
Next best is to attach to it with a debugger and set breakpoints around important events.
You don't tell us what this service does or how it works, but if you want to watch what file handles the process has open during normal operation, in my opinion Sysinternals' Process Explorer is the easiest way to do it. You can also see file system activity taking place in real time with Process Monitor, filtering the results to the just process you want to see.
If the service was written properly, it will decommit all of its resources in some sort of graceful way before the process exits (when shut down through the service manager,) or at least the ones that would lead to data loss if they weren't.
sc query your-servicewill give you what the Service Manager thinks the service is capable of, but again it is ultimately up to how the service was written as to whether the functionality was properly implemented or not.Edit: That your service hangs when you try to stop it tells me that it wasn't written properly.
Edit: Oh and one last thing, if you want to do something scripty with this, handle.exe is a command-line program to monitor handles. You could parse its output. All these Sysinternals utilities are up on the WebDAV share \live.sysinternals.com\Tools\