[SOLUTION] script for querying which services run under administrator account?

script for querying which services run under administrator account?

Hi,

Anyone have a script that can be run on the server console that will report back which of the local services use the domain administrator account for 'log on as' ? ideally, the value one searches on would be a prompted input in the script ("please enter domain\username to match")

or even better, it would simply output the username used for all local services to a csv then I could check after the fact. (service name, starts-in-path, "log on as" user, startup-type.

would be useful in planning for high-level account password changes.

bonus: run on one server, and prompt the user for hostnames to query, or pull those hostnames from a text file (host1 <cr> host2 <cr>) assuming the user you ran the script on host0 had the rights to query the other hosts.

thanks,

The script below will dump all service accounts to a text file. Then you parse the text file for the string you want. Save the text below as script.vbs. Create a file called 'servers.txt' and populate it with a list of servers - start with a test server first. Then, from your computer go to a cmd prompt and type:

cscript script.vbs

The output file is svcaccounts.csv and it gets created.

Then open svcaccounts.csv in Excel and sort by the field that lists the administrator account and delete the rest.

On Error Resume Next
Dim oSvc,oPC, objNetwork
dim objFSO,objFile,objFile2

Const ForReading=1
Const ForWriting=2
set objNetwork=CreateObject("Wscript.Network")

ServerList="servers.txt" 'name of file with server names to check.
OutputFile="svcaccounts.csv" 'file to hold results

set objFSO=CreateObject("Scripting.FileSystemObject")
set objFile=objFSO.OpenTextfile(serverlist,forReading)
set objFile2=objFSO.CreateTextFile(OutPutfile)

do while objFile.AtEndofStream<>True
sTarget=objFile.Readline
wscript.echo "Enumerating Service Accounts on " & sTarget

Set oPC=GetObject("WinNT://"&sTarget)
'verify connectivity
tmp=oPC.Owner
If err.number<>0 Then
wscript.echo "Error connecting to " & sTarget
wscript.echo "Error #"&Err.Number & ": " & Err.Description
wscript.quit
End If

objFile2.WriteLine "Server,Display Name,Service Name,Service Account Name"
oPC.Filter=Array("service")
For Each svc In oPC
objFile2.WriteLine sTarget &"," & svc.DisplayName & "," & svc.Name & "," & svc.ServiceAccountName
Next

set oPC=Nothing
set objNetwork=Nothing

loop

objFile.close
objFile2.close

wscript.echo "See " & OutPutfile & " for results."

'EOF

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

LVL 51

Netman66Commented: 2010-03-24

If Powershell is installed then this will work:

get-WmiObject win32_service | format-table Name, StartName -auto | out-file "C:\services.txt"

Running it remotely can be done if Powershell is installed on the remote server using PSEXEC.

I'm sure there is a way to do this remotely using only powershell, but I'm a bit busy right now.

LVL 5

JohnDemerjianCommented: 2010-03-25

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial

LVL 2

hakalugiAuthor Commented: 2010-03-25

John,

works great, exactly what I was looking for.

Thanks.

script for querying which services run under administrator account?

Who is Participating?