ScooterOc
asked on
Script to find services with login accounts
I'm hoping someone can help me get this to work. I want to list services using login accounts but I want to filter out localsystem, 'NT AUTHORITY\NetworkService' and 'NT AUTHORITY\LocalService'. The script works with only the localsystem filter but returns null is 'NT AUTHORITY\*" is added.
strComputer = "myComputer"
UserName = ""
Password = ""
Set SWBemlocator = CreateObject("WbemScripting.SWbemLocator")
Set objWMIService = SWBemlocator.ConnectServer(strComputer,"root\CIMV2",UserName,Password)
Set colItems = objWMIService.ExecQuery("Select * from Win32_service where (startmode='auto' OR startmode='manual') AND StartName <> 'LocalSystem'" & _
"AND StartName <> 'NT AUTHORITY\NetworkService' AND StartName <> 'NT AUTHORITY\LocalService'",,48)
For Each objItem In colItems
wscript.Echo objItem.name, objItem.State, objItem.StartName
Next
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
add in credentials for login accounts....
ASKER
Thank you for the submittions, I took BigBadWolf's suggestion and moved part of the filter out of the query. I guess I must accept that WQL does not handle blank spaces within the constent very well. Unless someone can show me different, I'm going to consder this solved.
Set colItems = objWMIService.ExecQuery("Select * from Win32_service where (startmode='auto' OR startmode='manual')",,48)
For Each objItem In colItems
If UCASE(objItem.StartName) <> "NT AUTHORITY\NETWORKSERVICE" And UCASE(objItem.StartName) <> "LOCALSYSTEM" AND UCASE(objItem.StartName) <> "NT AUTHORITY\LOCALSERVICE" Then
wscript.Echo objItem.name, objItem.State, objItem.StartName
End if
Next
ASKER
The answer did not directly address the question but it did give me an idea to work around the problem.
https://www.experts-exchange.com/questions/24067885/Enumerate-Services-by-Credentials-either-via-Script.html
Dont think it is exactly like you want, but it might suit your needs, wanted to offer it anyway.....