List any Windows Services in the domain who use DOMAINAdministrator as service ?

Home Forums Scripting PowerShell List any Windows Services in the domain who use DOMAINAdministrator as service ?

This topic contains 5 replies, has 3 voices, and was last updated by Avatar nharrip 1 year, 5 months ago.

Viewing 6 posts - 1 through 6 (of 6 total)
  • Author
    Posts
  • Avatar
    Albertwt
    Member
    #155239

    Hi,

    I’m now performing an audit for my DOMAINAdministrator account, I wonder how is it possible using Powershell script through list of Servers in my domain and then display the result of:

    1. any services in each server who uses DOMAINAdministrator username
    2. if possible to list where is the DOMAINAdministrator login is currently used (using cmd prompt qwinsta)

    Any kind of help would be greatly appreciated.

    Thanks.

    tehcamel
    tehcamel
    Moderator
    #357707

    Re: List any Windows Services in the domain who use DOMAINAdministrator as service ?

    here;s a starting point for you:

    PS> get-wmiobject win32_service | gm
    this will give you a list of all the properties you can query

    also, this link
    http://www.send4help.net/change-remote-windows-service-credentials-password-powershel-495

    has a powershell script on how to change the credentials.. might be able to modify it a bit.. let me play for the remainder of my day.. :)

    get-wmiobject -namespace “rootcimv2” -class win32_Service | Ft name,processid
    gives me a table with the name of the service, and it’s process ID. I’m trying to figure out which I need for logonas

    hehe! here you go

    get-wmiobject -namespace “rootcimv2” -class win32_service | ft name,processid,startname

    that’ll give you name, process ID and the logonas field.

    It’s not what you want yet – but I’m sure you could use sort-list or soemthing, and then exclude anything Not domainadmin

    Avatar
    Albertwt
    Member
    #317957

    Re: List any Windows Services in the domain who use DOMAINAdministrator as service ?

    Yes tehcamel,

    many thanks for the reply. This is what I’ve been looking for.

    Cheers !

    tehcamel
    tehcamel
    Moderator
    #357713

    Re: List any Windows Services in the domain who use DOMAINAdministrator as service ?

    excellent :)
    I guess i’m not as crap at scripting as I thought.. I’ll try and do some more on it today.. work out how tofilter it etc

    Avatar
    Albertwt
    Member
    #317958

    Re: List any Windows Services in the domain who use DOMAINAdministrator as service ?

    tehcamel;241319 wrote:
    excellent :)
    I guess i’m not as crap at scripting as I thought.. I’ll try and do some more on it today.. work out how tofilter it etc

    you are great man :-)

    here’s my updated script, feel free to modify or optimize it again if you wish.

    Get-QADComputer -OSName “Windows*Server*” | Where-Object { Test-Connection $_.Name -Count 1 -Quiet } | Foreach-Object{
    Get-WmiObject -namespace “rootcimv2” -Class Win32_Service -ComputerName $_.Name -Filter “StartName=’DOMAIN\Administrator'” | Select-Object SystemName,DisplayName,Name,startname,State
    } | Export-Csv C:services.csv[/CODE][CODE]Get-QADComputer -OSName “Windows*Server*” | Where-Object { Test-Connection $_.Name -Count 1 -Quiet } | Foreach-Object{
    Get-WmiObject -namespace “rootcimv2” -Class Win32_Service -ComputerName $_.Name -Filter “StartName=’DOMAIN\Administrator'” | Select-Object SystemName,DisplayName,Name,startname,State
    } | Export-Csv C:services.csv[/CODE]

    Avatar
    nharrip
    Member
    #391947

    Few options to achieve this:

    1. Powershell (you need to filter by user name):
    Get-ADComputer -Filter {OperatingSystem -Like “Windows 10*”} | ForEach-Object {Get-WmiObject -Class Win32_Service -Computer $_.Name}

    Removed spam link. If you wish to advertise please contact the website owners.

Viewing 6 posts - 1 through 6 (of 6 total)

You must be logged in to reply to this topic.