CODEWITHSUNDEEP
powershell
user770022
user770022

Reputation: 2959

Search all servers for service account

There has to be a better way

$server = (Get-ADComputer -Filter * -Properties *).name
foreach ($s in $server)

{
Get-WmiObject Win32_Service -filter 'STARTNAME LIKE "%serviceaccount%"' -computername $s
}

I want to search all servers on the domain for a service account. The above kind of does what I'm looking for but it doesnt return what server the services account was found on. Thanks in advance.

Upvotes: 0

Views: 1204

Answers (1)

Lee_Dailey
Lee_Dailey

Reputation: 7489

here's what i meant about using Get-Member to find the object properties that would give you the info you want. [grin]

this could be sped up considerably by giving the G-WO call a list of systems. i wasn't ready to code that just now. lazy ... [blush]

what it does ...

  • sets the account to look for
    i only have the LocalSystem and NetworkService accounts listed on my services. [grin]
  • sets the computer list to search
    you will likely use Get-ADComputer. make sure to either use the property name in the loop OR to make your query return only the actual name value.
    i only have one system, so my list is 3 different ways to get to the same computer.
  • loops thru the systems
  • call G-WO to get the service[s] that use the target account
  • builds a [PSCustomObect] with the wanted properties
  • sends that to the $Result collection
  • shows that on screen

the code ...

$TargetAccount = 'LocalSystem'
$ComputerList = @(
    'LocalHost'
    '127.0.0.1'
    $env:COMPUTERNAME
    )

$Result = foreach ($CL_Item in $ComputerList)
    {
    # i didn't want a gazillion services, so this uses array notation to grab the 1st item
    #    if you want all the items, remove the trailing "[0]"
    $GWMI_Result = @(Get-WmiObject -Class Win32_Service -Filter "STARTNAME LIKE '%$TargetAccount%'" -ComputerName $CL_Item)[0]

    [PSCustomObject]@{
        ComputerName = $GWMI_Result.SystemName
        AccountName = $GWMI_Result.StartName
        ServiceName = $GWMI_Result.Name
        }
    }

$Result

output ...

ComputerName AccountName ServiceName                
------------ ----------- -----------                
MySysName    LocalSystem AMD External Events Utility
MySysName    LocalSystem AMD External Events Utility
MySysName    LocalSystem AMD External Events Utility

Upvotes: 1

Related Questions