How can I list the user account names that a Service is using on a PC?

Question

How can I list the user account names that a Service is using on a PC?

IT-User9733 71

Hi, how can I list the user account names that a Service is using on a PC?

I am only interested in the the Services that have been configured to run under users accounts, and not the NT Authority or Systems ones etc.

I would like to scan all of our machines. so that I can see what Service and/or Services are using user accounts.

Is this possible.

Thanks

3 answers

Your answer

Answer 1

Anonymous

Here you go.
https://devblogs.microsoft.com/scripting/the-scripting-wife-uses-powershell-to-find-service-accounts/

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

Anonymous

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--

IT-User9733 71 Reputation points

2021-08-12T21:36:31.7+00:00

thanks DS,

I was looking for something that could scan a group of pcs in my domain and returns the service accounts that were running under a particular user account.

For example something like this :

AllComputersInDomain = Get-AllComputersInDomain
Get-WmiObject win32_service -AllComputersInDomain | Where-Object {$_.startupname -like “user1”} | Format-Table name,startname,

Is that possible.

Thanks
Rich Matheisen 47,901 Reputation points

2021-08-13T01:51:31.26+00:00
The cmdlet that'll do that "Get-AllComputersInDomain" is called Get-ADComputer. So, something like this:

Get-WmiObject win32_service -ComputerName (Get-ADComputer) | Where-Object {$_.startupname -like “user1”} | Format-Table name,startname
IT-User9733 71 Reputation points

2021-08-14T08:40:31.033+00:00

Hi Rich,

Yes I need something like that but my PS is not that great.

I will have to try and make something that works.

I think I might have to collect a list and loop through them like DSPatrick mentions below.

Thanks

Rich Matheisen 47,901

The Get-WmiObject takes a list of names as an argument for the -ComputerName parameter.

If you want to put the results into an array, and you're only looking for a single user whose name is exactly "user1":

[array]$list = Get-WmiObject win32_service -ComputerName (Get-ADComputer -Filter *) | 
     Where-Object {$_.startupname -eq "user1"} |
        Select-Object name,startupname

. . . and if you have a list of users:

$accts = 'user1','user2','user3'

[array]$list = Get-WmiObject win32_service -ComputerName (Get-ADComputer -Filter *) | 
     Where-Object {$accts -contains $_.startupname} |
        Select-Object name,startname

IT-User9733 71 Reputation points

2021-08-15T07:55:38.99+00:00

Hi Rich,

Thanks for that.

I tried using them but I run issues. It threw the following error for all of the machines.

Get-WmiObject : The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)

I suspect that it is Firewall Related or the Service is not turned on for Remote Procedure Call.
Rich Matheisen 47,901 Reputation points

2021-08-15T18:11:24.387+00:00
Do you encounter the same error if you supply a list of computer name for the -ComputerName parameter (e.g. -ComputerName ws01,ws02,ws03")?

If that works, try changing this line of the script:

[array]$list = Get-WmiObject win32_service -ComputerName (Get-ADComputer -Filter *) |

. . . to this:

[array]$list = Get-WmiObject win32_service -ComputerName (Get-ADComputer -Filter * | Select-Object -Expand Name) |

Answer 3

Anonymous

You'll probably need to build a list of computers then loop through the computer list.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Share via

How can I list the user account names that a Service is using on a PC?

3 answers

Your answer