Link to home
Start Free TrialLog in
Avatar of ScooterOc
ScooterOcFlag for United States of America

asked on

Script to find services with login accounts

I'm hoping someone can help me get this to work. I want to list services using login accounts but I want to filter out localsystem, 'NT AUTHORITY\NetworkService' and 'NT AUTHORITY\LocalService'. The script works with only the localsystem filter but returns null is 'NT AUTHORITY\*" is added.
strComputer = "myComputer"
UserName = ""
Password = ""
Set SWBemlocator = CreateObject("WbemScripting.SWbemLocator")
Set objWMIService = SWBemlocator.ConnectServer(strComputer,"root\CIMV2",UserName,Password)
Set colItems = objWMIService.ExecQuery("Select * from Win32_service where (startmode='auto' OR startmode='manual') AND StartName <> 'LocalSystem'" & _
"AND StartName <> 'NT AUTHORITY\NetworkService' AND StartName <> 'NT AUTHORITY\LocalService'",,48)

For Each objItem In colItems
	 wscript.Echo objItem.name, objItem.State, objItem.StartName
Next

Open in new window

Avatar of johnb6767
johnb6767
Flag of United States of America image

This is similar to what I was asking at one time, and I got a great response from AmazingTech.....
https://www.experts-exchange.com/questions/24067885/Enumerate-Services-by-Credentials-either-via-Script.html
Dont think it is exactly like you want, but it might suit your needs, wanted to offer it anyway.....
ASKER CERTIFIED SOLUTION
Avatar of BigBadWolf_000
BigBadWolf_000
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
add in credentials for login accounts....
Avatar of ScooterOc

ASKER

Thank you for the submittions, I took BigBadWolf's suggestion and moved part of the filter out of the query. I guess I must accept that WQL does not handle blank spaces within the constent very well. Unless someone can show me different, I'm going to consder this solved.


Set colItems = objWMIService.ExecQuery("Select * from Win32_service where (startmode='auto' OR startmode='manual')",,48)
For Each objItem In colItems
	 If UCASE(objItem.StartName) <> "NT AUTHORITY\NETWORKSERVICE" And UCASE(objItem.StartName) <> "LOCALSYSTEM" AND UCASE(objItem.StartName) <> "NT AUTHORITY\LOCALSERVICE" Then
	 	wscript.Echo objItem.name, objItem.State, objItem.StartName
	 End if
Next

Open in new window

The answer did not directly address the question but it did give me an idea to work around the problem.