Solved

Service Account - Which servers are using it?

Posted on 2014-04-28
5
334 Views
Last Modified: 2014-04-30
Hi Guys,

I need to find out which servers, computers, software etc are using a service account on my active directory, how can I find this information out?

Thank you in advance.

K
0
Comment
Question by:Kay
  • 2
  • 2
5 Comments
 
LVL 16

Assisted Solution

by:gurutc
gurutc earned 333 total points
Comment Utility
Hi,

You can set a login script for the svc account userid that could be as simple as

echo >>%computername% \\domain\netlogon\svcacctpcs.txt

So whenever the service account userid logs in it will update that text file.

There are more complicated solutions but this should work for you.

- gurutc
0
 
LVL 9

Assisted Solution

by:VirastaR
VirastaR earned 167 total points
Comment Utility
0
 

Author Comment

by:Kay
Comment Utility
Hi Guru TC,

That script doesn't work, I tried it first without applying as logon script, there is something wrong with the code it self, when I try just echo >> %computername% this doesn't output anything.

thanks any way.
0
 

Author Comment

by:Kay
Comment Utility
I've tried

echo %computername% >> \\ds.we.tre.uk\netlogon\svcacctpcs.txt,

however when I check the text file it gives me Chinese characters

¿¿¿¿¿¿¿¿¿¿
0
 
LVL 16

Accepted Solution

by:
gurutc earned 333 total points
Comment Utility
Not sure why that's happening.  Another way we track failed logons which would also work for successful logons is to use psloglist from sysinternals.

you could run the following in a batch file on one of your DCs as a scheduled task every 5 minutes:

rem begin batch

psloglist /accepteula \\domaincontroller1,domaincontroller2 -i 528 security -s -m 5 |findstr /I "svcacct"  >>testdc.001

Set CURRDATE=CURRDATE.TMP
Set CURRTIME=CURRTIME.TMP

DATE /T > %CURRDATE%
TIME /T > %CURRTIME%

Set PARSEARG="eol=; tokens=1,2,3,4* delims=/, "
For /F %PARSEARG% %%i in (%CURRDATE%) Do SET YYYYMMDD=%%l%%k%%j

Set PARSEARG="eol=; tokens=1,2,3* delims=:, "
For /F %PARSEARG% %%i in (%CURRTIME%) Do Set HHMM=%%i%%j%%k

RENAME testdc1.001  %YYYYMMDD%%HHMM%.txt

rem end batch

This will create files every 5 minutes tracking your service account's logins.
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Suggested Solutions

Set OWA language and time zone in Exchange for individuals, all users or per database.
Resolve DNS query failed errors for Exchange
This tutorial will give a short introduction and overview of Backup Exec 2012 and how to navigate and perform basic functions. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as conne…
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now