CODEWITHSUNDEEP
powershellactive-directorypowershell-2.0windows-users
plaidshirt
plaidshirt

Reputation: 5671

Check if user is service account

I try to decide with use of host command below if a given username is service account or not.

Get-ADUser $username -Properties PasswordNeverExpires |
  where { $_.PasswordNeverExpires -eq "true" } |
  where { $_.Enabled -eq "true"}

It should return only with one value, maybe with a True or False. How could I do this?

Upvotes: 0

Views: 8036

Answers (2)

J Weezy
J Weezy

Reputation: 3957

I do not believe Mathias's answer is correct. To determine whether a given sAMAccountName is a service account see the following:

https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adserviceaccount?view=winserver2012-ps

The powershell command is:

Get-ADServiceAccount -Identity Service1

where 'Service1' is the sAMAccountName.

Update:

I have a similar posting to this question, but my goal was to get all managed service accounts through C# LDAP filter (see link below).

Active Directory: How to determine whether account is service account?

https://blogs.technet.microsoft.com/askds/2009/09/10/managed-service-accounts-understanding-implementing-best-practices-and-troubleshooting/

I hope this helps.

Upvotes: 1

Mathias R. Jessen
Mathias R. Jessen

Reputation: 174525

Cast the expression to a [bool] - if no user with those criteria exist it will be $false, otherwise $true:

$SAExists = [bool](Get-ADUser -Filter {SAMAccountName -eq $username -and PasswordNeverExpires -eq $true -and Enabled -eq $true})

Upvotes: 0

Related Questions