Announcement

Collapse
No announcement yet.

List any Windows Services in the domain who use DOMAIN\Administrator as service ?

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • List any Windows Services in the domain who use DOMAIN\Administrator as service ?

    Hi,

    I'm now performing an audit for my DOMAIN\Administrator account, I wonder how is it possible using Powershell script through list of Servers in my domain and then display the result of:

    1. any services in each server who uses DOMAIN\Administrator username
    2. if possible to list where is the DOMAIN\Administrator login is currently used (using cmd prompt qwinsta)

    Any kind of help would be greatly appreciated.

    Thanks.

  • #2
    Re: List any Windows Services in the domain who use DOMAIN\Administrator as service ?

    here;s a starting point for you:

    PS> get-wmiobject win32_service | gm
    this will give you a list of all the properties you can query

    also, this link
    http://www.send4help.net/change-remo...-powershel-495

    has a powershell script on how to change the credentials.. might be able to modify it a bit.. let me play for the remainder of my day..


    get-wmiobject -namespace "root\cimv2" -class win32_Service | Ft name,processid
    gives me a table with the name of the service, and it's process ID. I'm trying to figure out which I need for logonas

    hehe! here you go

    get-wmiobject -namespace "root\cimv2" -class win32_service | ft name,processid,startname

    that'll give you name, process ID and the logonas field.

    It's not what you want yet - but I'm sure you could use sort-list or soemthing, and then exclude anything Not domain\admin
    Last edited by tehcamel; 29th June 2011, 18:02.
    Please do show your appreciation to those who assist you by leaving Rep Point https://www.petri.com/forums/core/im.../icon_beer.gif

    Comment


    • #3
      Re: List any Windows Services in the domain who use DOMAIN\Administrator as service ?

      Yes tehcamel,

      many thanks for the reply. This is what I've been looking for.

      Cheers !

      Comment


      • #4
        Re: List any Windows Services in the domain who use DOMAIN\Administrator as service ?

        excellent
        I guess i'm not as crap at scripting as I thought.. I'll try and do some more on it today.. work out how tofilter it etc
        Please do show your appreciation to those who assist you by leaving Rep Point https://www.petri.com/forums/core/im.../icon_beer.gif

        Comment


        • #5
          Re: List any Windows Services in the domain who use DOMAIN\Administrator as service ?

          Originally posted by tehcamel View Post
          excellent
          I guess i'm not as crap at scripting as I thought.. I'll try and do some more on it today.. work out how tofilter it etc
          you are great man

          here's my updated script, feel free to modify or optimize it again if you wish.

          Code:
          Get-QADComputer -OSName "Windows*Server*" | Where-Object { Test-Connection $_.Name -Count 1 -Quiet } | Foreach-Object{
             Get-WmiObject -namespace "root\cimv2" -Class Win32_Service -ComputerName $_.Name -Filter "StartName='DOMAIN\\Administrator'" | Select-Object SystemName,DisplayName,Name,startname,State
          } | Export-Csv C:\services.csv

          Comment

          Working...
          X