Avatar of spinoza156
spinoza156
 asked on

How can I determine what accounts are logging in as a service

Hi.

We recently had an incident whereby a system was compromised. The SQL service on the system was running under our domain administrator account credentials. We are not sure if that account has it's password leaked but we want to be proactive and change the password.

The domain administrator account is used across many different servers in our organization for this purpose. If we change the password we will obviously cause all those services to fail their authentication.

My question is: Is there a tool that I can use that can scan a server or multiple servers to let me know exactly what accounts are used by services to authenticate?

Needless to say we will be using another account going forward.

Thanks!
Microsoft Legacy OSWindows OS

Avatar of undefined
Last Comment
spinoza156

8/22/2022 - Mon
becraig

Here is a quick script that you can feed server names into:

It will give you a list of services that are running under domain credentials.

$serviceinfo = @()
(gc serverlist.txt) | % {
$server = $_
gwmi win32_service -computername $_| where {$_.StartName -ne "LocalSystem" -and $_.StartName -ne "NT AUTHORITY\LocalService" -and $_.startname -ne "NT Authority\NetworkService"} | % { $serviceinfo +=  "$server, $_.Name, $_.StartName"  }
}
$serviceinfo | Select * | Export-Csv c:\service-reports.csv -NoTypeInformation

Open in new window

spinoza156

ASKER
Thanks becraig. My script knowledge is very limited. Is this a vbs script? Could you please provide an example of how you would run this with a server named 'foo'?
becraig

This is a powershell script.

Steps:
1. save the code snippet as a file possibly "script.ps1"
2. Open a powershell window Run - powershell -
3. Navigate to the path where you saved the script.ps1
4. Save a text file copy of your list of servers "serverlist.txt" in the same location
5. run the script by entering ./script.ps1
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes
spinoza156

ASKER
Ok. Thank you for the detail. I got the script to run, it created the file but it's empty. I created the serverlist.txt with the FQDN of one of my servers on the first line.
becraig

$serviceinfo = @()
(gc serverlist.txt) | % {
$server = $_
write-host "Processing Server ..." -fore yellow
gwmi win32_service -computername $server | where {$_.StartName -ne "LocalSystem" -and $_.StartName -ne "NT AUTHORITY\LocalService" -and $_.startname -ne "NT Authority\NetworkService"} | % { $serviceinfo +=  "$server, $_.Name, $_.StartName"  }
}
$serviceinfo | Select * | Export-Csv c:\service-reports.csv -NoTypeInformation

Open in new window



Made a quick update to a bad pipe.
spinoza156

ASKER
Thanks. I get the Processing Server... but still the same result.
I tried using the hostname of my local machine and it came back with attached.capture
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
becraig

$serviceinfo = @()
(gc serverlist.txt) | % {
$server = $_
write-host "Processing Server ..." -fore yellow
gwmi win32_service -computername $server | where {$_.StartName -ne "LocalSystem" -and $_.StartName -ne "NT AUTHORITY\LocalService" -and $_.startname -ne "NT Authority\NetworkService"} | % { 
$sname = $_.Name; $sacct = $_.StartName
$serviceinfo +=  "$server, $sname, $sacct"  
}
}

$serviceinfo | out-file c:\service-reports.csv 

Open in new window

spinoza156

ASKER
This is the result.capture
ASKER CERTIFIED SOLUTION
becraig

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
spinoza156

ASKER
You are right.

I have to run it locally on the server though to get it to work.
Thanks!
This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.
rwheeler23