How to Determine Running Services using PowerShell

I have multiple service accounts that are logged in.  I need to determine, using PowerShell, what services these accounts associated with.   My environment is primarily composed of Windows servers. Any samples or examples of a PowerShell script that will help me with this problem would be appreciated.  

Lipotech
lipotechSys EngAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

oBdACommented:
This will get you all services and their associated logon account:
Get-WmiObject -Namespace "Root\CIMv2" -Class "Win32_Service" | Select-Object Name, DisplayName, StartName

Open in new window

This works remote, too:
Get-WmiObject -Namespace "Root\CIMv2" -Class "Win32_Service" -ComputerName SomeServer | Select-Object PSComputerName, Name, DisplayName, StartName

Open in new window

Or a list of server names:
Get-Content -Path ServerList.txt | % {Get-WmiObject -Namespace "Root\CIMv2" -Class "Win32_Service" -ComputerName $_ | Select-Object PSComputerName, Name, DisplayName, StartName}

You can filter that further to your needs; for example, to filter out all the default accounts (LocalService, NetworkService, LocalSystem):
Get-WmiObject -Namespace "Root\CIMv2" -Class "Win32_Service" | Select-Object Name, DisplayName, StartName | ? {"NT AUTHORITY\LocalService", "NT AUTHORITY\NetworkService", "LocalSystem" -notcontains $_.StartName}

Open in new window

Mohammed KhawajaManager - Infrastructure:  Information TechnologyCommented:
get-service is what I would suggest.  To learn more about services using PowerShell, I suggest your run get-help get-service and try the different options (i.e. -examples, -full, -details, etc.)
oBdACommented:
Get-Service does not provide the account the service is running under.
Discover the Answer to Productive IT

Discover app within WatchGuard's Wi-Fi Cloud helps you optimize W-Fi user experience with the most complete set of visibility, troubleshooting, and network health features. Quickly pinpointing network problems will lead to more happy users and most importantly, productive IT.

Mohammed KhawajaManager - Infrastructure:  Information TechnologyCommented:
You are absolutely right, mea culpa.
lipotechSys EngAuthor Commented:
I am trying the different recommendations suggested.  I will update this request in a bit.

Lipotech
Joshua GrantomSenior Systems AdministratorCommented:
Here is a reduced version of a script I used to query all windows servers and check what accounts were running all the services. We used this to determine if admins were using their personal AD accounts to run services instead of requesting a service account.

Make sure you are running this with an elevated account that has local admin rights to all servers or you will get an access denied.

$Computers= (Get-ADComputer -Filter {Enabled -eq $True -and OperatingSystem -like "*server*"}).name
$ErrorLog = "C:\ServiceAccountsError.log"
ForEach ($Computer in $Computers)
{
Write-Host $Computer
Get-WmiObject  -Impersonation 3 -Authentication PacketPrivacy -ComputerName $Computer -class Win32_Service -ErrorAction Continue 2>>$ErrorLog | 
Where-Object -FilterScript {$_.StartName -ne "LocalSystem" -or "NT AUTHORITY\Network Service" -or "NT AUTHORITY\NetworkService" -or "NT AUTHORITY\Local Service" -or "NT AUTHORITY\LocalService" -or "NT AUTHORITY\SYSTEM"} |
Select-Object -Property StartName,Name,DisplayName
}

Open in new window


Hope this helps

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
lipotechSys EngAuthor Commented:
Just now circling back to this problem.  Sorry for the delayed response.  The life of Big IT!  I will be reviewing each comment today and testing recommendations.  I thank each of you for your support.

lipotech
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Powershell

From novice to tech pro — start learning today.