How do I find Windows Services running with a Service Account?

green

In many environments, the same domain administrator account can be found linked to Windows Services all over the place for all kinds of reasons, and these need to be found and replaced.

Then there are times when you need to reset the password for a service account, but are not sure where it’s being used.  The following scripts will assist with these dilemmas.

To find all servers with services running with a service account the first script below uses the Active Directory PowerShell modules to get all servers, then individually queries each server for all services that are not running with the “NT Authority” or “LOCALSYSTEM” accounts (which should just leave custom service accounts).

 

 

To find all servers with services running with a specific service account the script from above has been modified to now search for services running with the “sql.service” service account (which can easily be modified to any account name).

 

 green

2 Comments How do I find Windows Services running with a Service Account?

  1. Dan RIdge

    This has helped so much!
    Possible to add code to search in multiple domain (or allow me to specify other domains or even a forest?)
    Possible to add code to export of returned info to a .csv file?
    Thank you!

    Reply
    1. Kamal

      The easiest way to get the data into a CSV, is to:
      1) remove the write-host line.
      2) replace that line with these two lines:

      $out = $server.name + "," + $service.caption + "," + $service.startname;
      $out >> c:\temp\results.csv;

      Reply

Leave a Reply

Your email address will not be published. Required fields are marked *