Solved

How can I find out what accounts are running what services across my windows 2k3 domain?

Posted on 2009-04-07
8
220 Views
Last Modified: 2012-05-06
Following an outbreak of conficker my client has restricted access to launch exe as services and the like.  Upon relaxing the security we are finding that certain services are not lauching eg dhcp client.  This is down to permissions I know however I would like to find out what accounts are associated to what services as we have serveral instances where the same service is local system on one machine and network service on another
0
Comment
Question by:nashton99
  • 4
  • 4
8 Comments
 
LVL 9

Expert Comment

by:sda100
ID: 24087190
This batch script below will give you the information you need - I've chosen to just echo the information out in CSV format, but you can do what like with it.

You'll be using the Windows-supplied tool, SC.EXE and you'll also need to use a .VBS script which you can download from here (extract it from the ZIP):

Sample output:

WZCSVC, Wireless Zero Configuration, AUTHORITY\NetworkService
xmlprov, Network Provisioning Service, AUTHORITY\NetworkService
SAVService, Sophos Anti-Virus, AUTHORITY\LocalService
SAVAdminService, Sophos Anti-Virus status reporter, AUTHORITY\LocalService
Steve :)

@echo off
SetLocal EnableDelayedExpansion
for /f "tokens=1,*" %%i in ('cscript //NoLogo check_service.wsf /info') do (
    if "%%i"=="Service:" (
        set ShortName=%%j
    ) else (
        if "%%i"=="Description:" (
			set LongName=%%j
			for /f "usebackq tokens=4" %%k in (`sc qc !ShortName!^|find "SERVICE_START_NAME"`) do (
				set StartName=%%k
			)
			echo !ShortName!, !LongName!, !StartName!
        )
    )
)

Open in new window

0
 

Author Comment

by:nashton99
ID: 24087518
Thanks have downloaded and will give it a try, I am not much of a vbs programmer, so may need some more help.  Does anyone know of anything  that has a nice gui
0
 
LVL 9

Expert Comment

by:sda100
ID: 24087733
You don't need to touch the VBS.  If you look at line 12 of the code snippet above (it's a DOS batch file), I echo out 3 values.  It's up to you what you want to do with them... anything tricky, just post back again.

Steve :)
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 

Author Comment

by:nashton99
ID: 24090941
thats great and I can run it fine, but what i would really like to do is run it from a client aqnd check all servers on, the domain and then produce a report, any further tips would be greatly appreciated.  
0
 
LVL 9

Expert Comment

by:sda100
ID: 24097915
Depending on how many servers you have, I think the easiest way might be to use a GPO and configure it to run as a login script (for Administrator?).  You could then adapt the batch file to copy its output to a network share, in a file named %COMPUTERNAME%.TXT, for example?

Take a look at the modified batch file below.

Steve :)

@echo off
SetLocal EnableDelayedExpansion
 
set NetworkDir=\\<SERVER>\<SHARE>
 
for /f "tokens=1,*" %%i in ('cscript //NoLogo check_service.wsf /info') do (
    if "%%i"=="Service:" (
        set ShortName=%%j
    ) else (
        if "%%i"=="Description:" (
            set LongName=%%j
            for /f "usebackq tokens=4" %%k in (`sc qc !ShortName!^|find "SERVICE_START_NAME"`) do (
                set StartName=%%k
            )
            echo !ShortName!, !LongName!, !StartName!>>"%0.out"
        )
    )
)
 
if exist "%0.out" (
    move "%0.out" "%NetworkDir%\%COMPUTERNAME%.txt"
    del "%0.out"
)

Open in new window

0
 
LVL 9

Accepted Solution

by:
sda100 earned 125 total points
ID: 24097924
You could also play with the PsTools package from Microsoft/Sysinternals to run this remotely.

Steve :)
0
 

Author Comment

by:nashton99
ID: 24110578
Thanks again steve been out of the office today but will have a play over the weekend with pstools and the batch file etc.  But I am liking the idea.
0
 

Author Closing Comment

by:nashton99
ID: 31567481
Really basic auditing sorting thank you.  Simple, effective and fast solution
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Questions about DHCP migration 5 61
Active Directory uninstall Windows 2008 R2 6 85
GPO not showing IE10 in GP Preferences 14 47
WMI - Issue Server 2012 R2 1 9
Is your Office 365 signature not working the way you want it to? Are signature updates taking up too much of your time? Let's run through the most common problems that an IT administrator can encounter when dealing with Office 365 email signatures.
This article shows how to deploy dynamic backgrounds to computers depending on the aspect ratio of display
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question