We help IT Professionals succeed at work.

Identify administrator account use for server/desktop services

CollinMendoza
on
82 Views
Last Modified: 2017-12-18
I am trying to identify one of my retired admin (user) account and disable the account. But before I disable the account, I need to scan my domain if his account was used on any of the server or desktop services. Is there a tool or scrip that I can  use to scan my network and identify the devices where his account was used. Please advise.

Thank you
Collin
Comment
Watch Question

Lionel MMSmall Business IT Consultant
CERTIFIED EXPERT

Commented:
You can use this solution from scripting guy to show all services and then see if this user is set to run any services https://blogs.technet.microsoft.com/heyscriptingguy/2012/02/15/the-scripting-wife-uses-powershell-to-find-service-accounts/
CollinMendozaIT Director

Author

Commented:
Lionel, thank you. this will only give me to log in to each of the devices I know and run the power shell. I need to be able to scan the network for the unknown. I'm trying to scan my network to see if I missed any device that has his account setup to run the services.
Lionel MMSmall Business IT Consultant
CERTIFIED EXPERT

Commented:
Sorry then I don't know how to help -- only thing I do is to disable the account and see if anything goes wrong but that can be a tricky and dangerous approach to take.
CollinMendozaIT Director

Author

Commented:
Yes I thought about that too.
CollinMendozaIT Director

Author

Commented:
Hi expert, Is there a tool or another solution to identify the domain admin/user account if use for any services or task scheduler in the network?

Please advise.
Small Business IT Consultant
CERTIFIED EXPERT
Commented:
This problem has been solved!
(Unlock this solution with a 7-day Free Trial)
UNLOCK SOLUTION
Lionel MMSmall Business IT Consultant
CERTIFIED EXPERT

Commented:
Did my last comment help? If not what is it not doing; i.e. what is missing?
Lionel MMSmall Business IT Consultant
CERTIFIED EXPERT

Commented:
No further response from questioner so I am assuming my final suggestion worked to solve the issue.