This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(28.799999999999997, 89%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAA%3C/text%3E%3C/svg%3E)
Hello :)
I am looking for a powershell script to retrieve the list of local service accounts
Thank you
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 74%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERM%3C/text%3E%3C/svg%3E)
Define "service account"! Context is important.
If all you want is the name of a service and the account under which the service runs, then this will work:
Get-WmiObject Win32_Service | Select-Object name,startname
Context : An account allowing an application to be launched (as if you go to services.msc > you choose the service > login > account / password)
Well, that pretty much covers every LOCAL account on the machine, and in the Active Directory!
FYI, a "service" is a way to execute and manage long-running applications. Typical "user" application are run by a user, but only when they are logged on. Services are not typically created by normal users.
Or a summary.
Get-CimInstance win32_service | Where-Object {$_.StartName} | Select-Object StartName -Unique
To get even pickier:
$ignore = @(
"LocalSystem",
"NT AUTHORITY\LocalService",
"NT AUTHORITY\NetworkService"
)
Get-WmiObject Win32_Service |
Where-Object {$_.startname -AND $ignore -notcontains $_.startname} |
Select-Object name,startname
Brilliant!
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(41.6, 67%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKB%3C/text%3E%3C/svg%3E)
Here is a PowerShell script that retrieves the list of local service accounts on a Windows system:
Get-WmiObject Win32_UserAccount | Where-Object {$.LocalAccount -eq $True -and $.AccountType -eq "512"} | Select-Object Name
This script uses the Get-WmiObject cmdlet to retrieve a list of user accounts from the Win32_UserAccount WMI class. The Where-Object cmdlet filters the list to include only local accounts that have an AccountType value of 512, which represents service accounts. The Select-Object cmdlet is then used to display only the Name property of each service account.
only local accounts that have an
AccountTypevalue of 512, which represents service accounts.
I believe that 512 just indicates a normal local account. On my Win11 Home laptop, all accounts are 512's.
https://www.thewindowsclub.com/obtain-list-settings-details-user-accounts-windows
The "AccountType" (a.k.a. UserAccountControl) is a 32-bit integer that contains a bit mask. That "512" represents a "normal/typical" account, but if there's another property (e.g., the user cannot change the password) then the value becomes "544" (512 + 32).
The test for 512 would then fail. If all you're looking for is that bit that represents a "normal user" you'd have to test for it like this:
$AcctType = 512 + 32 # normal user and cannot change password
if ($AcctType -band 512){
Write-Host "Normal user"
}
else {
Write-Host "NOT a normal user"
}