Powershell cript to get list of services accounts

Ali AMG 0

Hello :)

I am looking for a powershell script to retrieve the list of local service accounts

Thank you

3 answers

Rich Matheisen 45,096 Reputation points

2023-02-03T22:22:13.06+00:00
Define "service account"! Context is important.

If all you want is the name of a service and the account under which the service runs, then this will work:

Get-WmiObject Win32_Service | Select-Object name,startname
Please sign in to rate this answer.
Ali AMG 0 Reputation points

2023-02-04T13:29:23.2666667+00:00

Context : An account allowing an application to be launched (as if you go to services.msc > you choose the service > login > account / password)

Rich Matheisen 45,096 Reputation points

2023-02-04T16:10:51.53+00:00

Well, that pretty much covers every LOCAL account on the machine, and in the Active Directory!

FYI, a "service" is a way to execute and manage long-running applications. Typical "user" application are run by a user, but only when they are logged on. Services are not typically created by normal users.
Sign in to comment
MotoX80 32,076 Reputation points

2023-02-03T22:32:15.13+00:00
Or a summary.

Get-CimInstance win32_service | Where-Object {$_.StartName} | Select-Object StartName -Unique
Please sign in to rate this answer.
Rich Matheisen 45,096 Reputation points

2023-02-04T00:36:22.0966667+00:00

To get even pickier:

$ignore = @( "LocalSystem", "NT AUTHORITY\LocalService", "NT AUTHORITY\NetworkService" ) Get-WmiObject Win32_Service | Where-Object {$_.startname -AND $ignore -notcontains $_.startname} | Select-Object name,startname

MotoX80 32,076 Reputation points

2023-02-04T13:14:18.3833333+00:00

Brilliant!
Sign in to comment
Ken Burns 0 Reputation points

2023-02-03T23:50:55.5066667+00:00

Here is a PowerShell script that retrieves the list of local service accounts on a Windows system:

Get-WmiObject Win32_UserAccount | Where-Object {$.LocalAccount -eq $True -and $.AccountType -eq "512"} | Select-Object Name

This script uses the Get-WmiObject cmdlet to retrieve a list of user accounts from the Win32_UserAccount WMI class. The Where-Object cmdlet filters the list to include only local accounts that have an AccountType value of 512, which represents service accounts. The Select-Object cmdlet is then used to display only the Name property of each service account.
Please sign in to rate this answer.
MotoX80 32,076 Reputation points

2023-02-04T13:44:12.5266667+00:00

only local accounts that have an AccountType value of 512, which represents service accounts.

I believe that 512 just indicates a normal local account. On my Win11 Home laptop, all accounts are 512's.

https://www.thewindowsclub.com/obtain-list-settings-details-user-accounts-windows

Rich Matheisen 45,096 Reputation points

2023-02-04T15:58:43.4533333+00:00

The "AccountType" (a.k.a. UserAccountControl) is a 32-bit integer that contains a bit mask. That "512" represents a "normal/typical" account, but if there's another property (e.g., the user cannot change the password) then the value becomes "544" (512 + 32).

The test for 512 would then fail. If all you're looking for is that bit that represents a "normal user" you'd have to test for it like this:

$AcctType = 512 + 32 # normal user and cannot change password if ($AcctType -band 512){ Write-Host "Normal user" } else { Write-Host "NOT a normal user" }
Sign in to comment