Service Account - Which servers are using it?

Posted on 2014-04-28
Medium Priority
Last Modified: 2014-04-30
Hi Guys,

I need to find out which servers, computers, software etc are using a service account on my active directory, how can I find this information out?

Thank you in advance.

Question by:Kay
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
LVL 16

Assisted Solution

gurutc earned 1332 total points
ID: 40026935

You can set a login script for the svc account userid that could be as simple as

echo >>%computername% \\domain\netlogon\svcacctpcs.txt

So whenever the service account userid logs in it will update that text file.

There are more complicated solutions but this should work for you.

- gurutc

Assisted Solution

VirastaR earned 668 total points
ID: 40026956

Author Comment

ID: 40029098
Hi Guru TC,

That script doesn't work, I tried it first without applying as logon script, there is something wrong with the code it self, when I try just echo >> %computername% this doesn't output anything.

thanks any way.

Author Comment

ID: 40029110
I've tried

echo %computername% >> \\ds.we.tre.uk\netlogon\svcacctpcs.txt,

however when I check the text file it gives me Chinese characters

LVL 16

Accepted Solution

gurutc earned 1332 total points
ID: 40029222
Not sure why that's happening.  Another way we track failed logons which would also work for successful logons is to use psloglist from sysinternals.

you could run the following in a batch file on one of your DCs as a scheduled task every 5 minutes:

rem begin batch

psloglist /accepteula \\domaincontroller1,domaincontroller2 -i 528 security -s -m 5 |findstr /I "svcacct"  >>testdc.001



Set PARSEARG="eol=; tokens=1,2,3,4* delims=/, "
For /F %PARSEARG% %%i in (%CURRDATE%) Do SET YYYYMMDD=%%l%%k%%j

Set PARSEARG="eol=; tokens=1,2,3* delims=:, "
For /F %PARSEARG% %%i in (%CURRTIME%) Do Set HHMM=%%i%%j%%k

RENAME testdc1.001  %YYYYMMDD%%HHMM%.txt

rem end batch

This will create files every 5 minutes tracking your service account's logins.

Featured Post

Office 365 Training for IT Pros

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I was prompted to write this article after the recent World-Wide Ransomware outbreak. For years now, System Administrators around the world have used the excuse of "Waiting a Bit" before applying Security Patch Updates. This type of reasoning to me …
In this post we will be converting StringData saved within a text file into a hash table. This can be further used in a PowerShell script for replacing settings that are dynamic in nature from environment to environment.
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses
Course of the Month10 days, 8 hours left to enroll

764 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question