Solved

Finding if Service Accounts are in use

Posted on 2011-02-21
11
330 Views
Last Modified: 2012-05-11
Hello,

We are retiring one AD domain to move to another. We are in the process of migrating users and I was appointed the task of finding out if service accounts are still in use on the domain. I was told I could use EventcombMT to search DC logs to try and find out if they are in use and what for. I tried running it by checking the security log for success audit and failure audit, and in the text field I put the service account name. I am getting zero results.

Does anyone have any suggestions on using EventcombMT to find this information? I have no background in scripting so that is not an option. I also only have access to free tools. Any advice would be helpful. Thanks.
0
Comment
Question by:SteveAD
  • 4
  • 4
  • 3
11 Comments
 
LVL 42

Accepted Solution

by:
Amit earned 500 total points
ID: 34943923
First of all service account and user account are same thing. The only difference with service account is, we change few settings. Like Password never expires.

The one option to find which account is working is to check with the application owners, who are using them

Second option is to check the lastlogon stamp.

Now the problem here is normally people configure the application with service account and don't logon for long time. Which again makes it diffcult to tarce them down.

Only way is to do it manually,

First check what are the accounts set with password never expires.
Check with the application team about those account, if they are using it or not
Once you have all above information, you can disable the suspected account and few weeks and see if any issue persist.

All above require manaul work and there is no shortcut to that, as service accounts are configured according to ur requirement

hope this helps
0
 

Author Comment

by:SteveAD
ID: 34944210
Thanks amitkulshrestha, the lastlogon stamp was one of my first ideas also. However, I was told that the last logon stamp is the last interactive login, not the last use of the account. The guy who assigned this task to me said that accounts used for services and applications don't update the login stamp. So he said I should try to search DC logs and that's where he said to use EventcombMT.

We have 180 service accounts on this list I have. Some of them I can contact the application teams, others, (that don't have much information) I'm stuck trying to search DC logs I guess.

Anyone have any other suggestions by chance, or use how I can use eventcombmt?

Thanks.
0
 
LVL 21

Expert Comment

by:snusgubben
ID: 34944613
How many servers do you have in your environment?
0
VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

 

Author Comment

by:SteveAD
ID: 34944683
I am new to this division of the company. In general, we have over 75 servers and we have 4 domain controllers.
0
 
LVL 21

Expert Comment

by:snusgubben
ID: 34944729
If you have a list of host names, i.e. csv, of the servers we could make a script checking.

Also if you have 180 service accounts, you should also have a csv-file for those.
0
 
LVL 42

Expert Comment

by:Amit
ID: 34944965
0
 

Author Comment

by:SteveAD
ID: 34944983
I do have a csv file for the service accounts, but not one for the servers. I'm sure there is one somewhere for it but since I'm new here I'll have to ask around. I have no experience scripting at all or really even running them,will that matter?
0
 
LVL 42

Assisted Solution

by:Amit
Amit earned 500 total points
ID: 34944986
Try this free tool

http://www.joeware.net/freetools/tools/adfind/index.htm

You can get lot of information
0
 
LVL 42

Assisted Solution

by:Amit
Amit earned 500 total points
ID: 34945025
0
 
LVL 21

Expert Comment

by:snusgubben
ID: 34945444
I have no experience scripting at all or really even running them,will that matter?

It will not matter :)
0
 

Author Comment

by:SteveAD
ID: 35007052
Thanks for the offer to build me a script snusgubben. I was not able to get a server list from my manager (security issues), so I just had to use some tools and do the best I could. Thanks though.
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction You may have a need to setup a group of users to allow local administrative access on workstations.  In a domain environment this can easily be achieved with Restricted Groups and Group Policies. This article will demonstrate how to…
While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question