Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

Script to find services with login accounts

Posted on 2010-01-11
5
Medium Priority
?
671 Views
Last Modified: 2012-05-08
I'm hoping someone can help me get this to work. I want to list services using login accounts but I want to filter out localsystem, 'NT AUTHORITY\NetworkService' and 'NT AUTHORITY\LocalService'. The script works with only the localsystem filter but returns null is 'NT AUTHORITY\*" is added.
strComputer = "myComputer"
UserName = ""
Password = ""
Set SWBemlocator = CreateObject("WbemScripting.SWbemLocator")
Set objWMIService = SWBemlocator.ConnectServer(strComputer,"root\CIMV2",UserName,Password)
Set colItems = objWMIService.ExecQuery("Select * from Win32_service where (startmode='auto' OR startmode='manual') AND StartName <> 'LocalSystem'" & _
"AND StartName <> 'NT AUTHORITY\NetworkService' AND StartName <> 'NT AUTHORITY\LocalService'",,48)

For Each objItem In colItems
	 wscript.Echo objItem.name, objItem.State, objItem.StartName
Next

Open in new window

0
Comment
Question by:ScooterOc
  • 2
  • 2
5 Comments
 
LVL 66

Expert Comment

by:johnb6767
ID: 26286299
This is similar to what I was asking at one time, and I got a great response from AmazingTech.....
http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Windows/XP/Q_24067885.html
Dont think it is exactly like you want, but it might suit your needs, wanted to offer it anyway.....
0
 
LVL 14

Accepted Solution

by:
BigBadWolf_000 earned 1500 total points
ID: 26286425
Try this....
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colServices = objWMIService.ExecQuery _
    ("Select * from Win32_Service where (startmode='auto' OR startmode='manual')")
For each objService in colServices 
    If objService.StartName = "LocalSystem" Then
        wscript.Echo objService.name, objService.State, objService.StartName
    End If

    If objService.StartName = "NT AUTHORITY\LocalService" Then
        wscript.Echo objService.name, objService.State, objService.StartName
    End If
    
    If objService.StartName = "NT AUTHORITY\NetworkService" Then
    wscript.Echo objService.name, objService.State, objService.StartName
    End If
    
Next

Set objWMIService = Nothing
Set colServices = Nothing

Open in new window

0
 
LVL 14

Expert Comment

by:BigBadWolf_000
ID: 26286448
add in credentials for login accounts....
0
 

Author Comment

by:ScooterOc
ID: 26287634
Thank you for the submittions, I took BigBadWolf's suggestion and moved part of the filter out of the query. I guess I must accept that WQL does not handle blank spaces within the constent very well. Unless someone can show me different, I'm going to consder this solved.


Set colItems = objWMIService.ExecQuery("Select * from Win32_service where (startmode='auto' OR startmode='manual')",,48)
For Each objItem In colItems
	 If UCASE(objItem.StartName) <> "NT AUTHORITY\NETWORKSERVICE" And UCASE(objItem.StartName) <> "LOCALSYSTEM" AND UCASE(objItem.StartName) <> "NT AUTHORITY\LOCALSERVICE" Then
	 	wscript.Echo objItem.name, objItem.State, objItem.StartName
	 End if
Next

Open in new window

0
 

Author Closing Comment

by:ScooterOc
ID: 31675658
The answer did not directly address the question but it did give me an idea to work around the problem.
0

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Have you considered what group policies are backwards and forwards compatible? Windows Active Directory servers and clients use group policy templates to deploy sets of policies within your domain. But, there is a catch to deploying policies. The…
Issue: One Windows 2008 R2 64bit server on the network unable to connect to a buffalo Device (Linkstation) with firmware version 1.56. There are a total of four servers on the network this being one of them. Troubleshooting Steps: Connect via h…
This Micro Tutorial will teach you how to add a cinematic look to any film or video out there. There are very few simple steps that you will follow to do so. This will be demonstrated using Adobe Premiere Pro CS6.
Enter Foreign and Special Characters Enter characters you can't find on a keyboard using its ASCII code ... and learn how to make a handy reference for yourself using Excel ~ Use these codes in any Windows application! ... whether it is a Micr…

564 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question