Solved

Service Account - Which servers are using it?

Posted on 2014-04-28
5
338 Views
Last Modified: 2014-04-30
Hi Guys,

I need to find out which servers, computers, software etc are using a service account on my active directory, how can I find this information out?

Thank you in advance.

K
0
Comment
Question by:Kay
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 16

Assisted Solution

by:gurutc
gurutc earned 333 total points
ID: 40026935
Hi,

You can set a login script for the svc account userid that could be as simple as

echo >>%computername% \\domain\netlogon\svcacctpcs.txt

So whenever the service account userid logs in it will update that text file.

There are more complicated solutions but this should work for you.

- gurutc
0
 
LVL 9

Assisted Solution

by:VirastaR
VirastaR earned 167 total points
ID: 40026956
0
 

Author Comment

by:Kay
ID: 40029098
Hi Guru TC,

That script doesn't work, I tried it first without applying as logon script, there is something wrong with the code it self, when I try just echo >> %computername% this doesn't output anything.

thanks any way.
0
 

Author Comment

by:Kay
ID: 40029110
I've tried

echo %computername% >> \\ds.we.tre.uk\netlogon\svcacctpcs.txt,

however when I check the text file it gives me Chinese characters

¿¿¿¿¿¿¿¿¿¿
0
 
LVL 16

Accepted Solution

by:
gurutc earned 333 total points
ID: 40029222
Not sure why that's happening.  Another way we track failed logons which would also work for successful logons is to use psloglist from sysinternals.

you could run the following in a batch file on one of your DCs as a scheduled task every 5 minutes:

rem begin batch

psloglist /accepteula \\domaincontroller1,domaincontroller2 -i 528 security -s -m 5 |findstr /I "svcacct"  >>testdc.001

Set CURRDATE=CURRDATE.TMP
Set CURRTIME=CURRTIME.TMP

DATE /T > %CURRDATE%
TIME /T > %CURRTIME%

Set PARSEARG="eol=; tokens=1,2,3,4* delims=/, "
For /F %PARSEARG% %%i in (%CURRDATE%) Do SET YYYYMMDD=%%l%%k%%j

Set PARSEARG="eol=; tokens=1,2,3* delims=:, "
For /F %PARSEARG% %%i in (%CURRTIME%) Do Set HHMM=%%i%%j%%k

RENAME testdc1.001  %YYYYMMDD%%HHMM%.txt

rem end batch

This will create files every 5 minutes tracking your service account's logins.
0

Featured Post

Is Your AD Toolbox Looking More Like a Toybox?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Background Information Recently I have fixed file server permission issues for one of my client. The client has 1800 users and one Windows Server 2008 R2 domain joined file server with 12 TB of data, 250+ shared folders and the folder structure i…
In-place Upgrading Dirsync to Azure AD Connect
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question