{"id":1329,"date":"2009-03-31T11:30:23","date_gmt":"2009-03-31T19:30:23","guid":{"rendered":"http:\/\/www.sapien.com\/blog\/2009\/03\/31\/get-serviceaccount-name-with-adsi\/"},"modified":"2009-03-31T11:30:23","modified_gmt":"2009-03-31T19:30:23","slug":"get-serviceaccount-name-with-adsi","status":"publish","type":"post","link":"https:\/\/dev.sapien.com\/blog\/2009\/03\/31\/get-serviceaccount-name-with-adsi\/","title":{"rendered":"Get ServiceAccount Name with ADSI"},"content":{"rendered":"

One drawback to the service objects returned from Get-Service<\/strong> is that you can’t see what account the service is running under, often referred to as the service account. This will be something like LocalService or perhaps even a special user account like Mydomain\\svcAccount123. You can retrieve this information by querying Windows Management Instrumentation (WMI) and the Win32_Service class. But did you know you can also use ADSI?<\/p>\n

First connect to the computer:<\/p>\n

PS C:\\> [ADSI]$server=”WinNT:\/\/$env:computername”<\/font><\/p>\n

The services will be child objects like users and groups. However, you need a little coding to coax them out into the open.<\/p>\n

PS C:\\> $server.psbase.children | where {$_.SchemaClassName -eq “Service”}<\/font><\/p>\n

You should get a list of service objects. But if our goal is to simply retrieve the service account name, how about a script?<\/p>\n

\n
\n
#Get-ServiceAccountName.ps1<\/span><\/pre>\n
Param ([string]$computername=$env:computername)<\/pre>\n
 <\/pre>\n
[ADSI]$server=\"WinNT:\/\/$computername\"<\/span><\/pre>\n
$server.psbase.children | where {$_.SchemaClassName -eq<\/span> \"Service\"<\/span>} | <\/pre>\n
select @{name=\"Computername\"<\/span>;Expression={$computername.toUpper()}},`<\/pre>\n
@{name=\"Service\"<\/span>;Expression={$_.name}},`<\/pre>\n
@{name=\"DisplayName\"<\/span>;Expression={$_.DisplayName}},`<\/pre>\n
@{name=\"AccountName\"<\/span>;Expression={$_.ServiceAccountName}},`<\/pre>\n
@{name=\"Path\"<\/span>;Expression={$_.Path}}<\/pre>\n
# end of script<\/span><\/pre>\n<\/div>\n<\/div>\n
The script takes a computer name as a parameter, defaulting to the local computer. The script queries the service objects and returns a custom object like this:<\/p>\n
Computername : CHAOS
Service      : SQLWriter
DisplayName  : SQL Server VSS Writer
AccountName  : LocalSystem
Path         : “C:\\Program Files\\Microsoft SQL Server\\90\\Shared\\sqlwriter.exe”<\/font><\/p>\n
I include the computername so that if you process a list of computers and want to save the output you can keep track of which service is on which computer.<\/p>\n
PS C:\\> get-content servers.txt | foreach {c:\\scripts\\get-serviceaccountname.ps1 $_ } | export-csv svcaccounts.csv<\/font><\/p>\n
Or perhaps you’d this wrapped up in a function:<\/p>\n
\n
\n
Function Get-ServiceAccountName {<\/pre>\n
    Param ([string]$computername=$env:computername)<\/pre>\n
    <\/pre>\n
    [ADSI]$server=\"WinNT:\/\/$computername\"<\/span><\/pre>\n
    $server.psbase.children | where {$_.SchemaClassName -eq<\/span> \"Service\"<\/span>} | <\/pre>\n
    select @{name=\"Computername\"<\/span>;Expression={$computername.toUpper()}},`<\/pre>\n
    @{name=\"Service\"<\/span>;Expression={$_.name}},`<\/pre>\n
    @{name=\"DisplayName\"<\/span>;Expression={$_.DisplayName}},`<\/pre>\n
    @{name=\"AccountName\"<\/span>;Expression={$_.ServiceAccountName}},`<\/pre>\n
    @{name=\"Path\"<\/span>;Expression={$_.Path}}<\/pre>\n
}<\/pre>\n<\/div>\n<\/div>\n
Nothing really changes. Or perhaps you’d like a function that accepts pipelined input:<\/p>\n
\n
\n
Function Get-ServiceAccountName {<\/pre>\n
PROCESS {<\/pre>\n
    [string]$computername=$_<\/pre>\n
        <\/pre>\n
    [ADSI]$server=\"WinNT:\/\/$computername\"<\/span><\/pre>\n
    <\/pre>\n
    $server.psbase.children | where {$_.SchemaClassName -eq<\/span> \"Service\"<\/span>} | <\/pre>\n
    select @{name=\"Computername\"<\/span>;Expression={$computername.toUpper()}},`<\/pre>\n
    @{name=\"Service\"<\/span>;Expression={$_.name}},`<\/pre>\n
    @{name=\"DisplayName\"<\/span>;Expression={$_.DisplayName}},`<\/pre>\n
    @{name=\"AccountName\"<\/span>;Expression={$_.ServiceAccountName}},`<\/pre>\n
    @{name=\"Path\"<\/span>;Expression={$_.Path}}<\/pre>\n
 }<\/pre>\n
}<\/pre>\n<\/div>\n<\/div>\n
Now you can run expressions like these:<\/p>\n
PS C:\\> “ServerA”,”ServerB1″ | get-serviceAccountname | Sort Computername,Accountname | format-table computername,Service,Accountname
PS C:\\> Get-Content computers.txt | get-serviceAccountname | where {$_.accountname -match “administrator”}<\/font> <\/p>\n
The second example will return all accounts with “administrator” in the name; handy if you want to see which services are running as a domain or local administrator. <\/p>\n
This function comes in handy come audit time. By the way, you need administrative rights on any remote computer. There isn’t a way to pass alternate credentials, but even if you have a drive mapped with alternate credentials, that will be sufficient. <\/p>\n
\n
Download a text file with all these variations here.<\/a><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
One drawback to the service objects returned from Get-Service is that you can’t see what account the service is running under, often referred to as the service account. This will be something like LocalService or perhaps even a special user account like Mydomain\\svcAccount123. You can retrieve this information by querying Windows Management Instrumentation (WMI) and the Win32_Service class. But did you know you can also use ADSI?<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[25],"tags":[280,198,468,28,300,488],"class_list":["post-1329","post","type-post","status-publish","format-standard","hentry","category-windows-powershell","tag-adsi","tag-function","tag-pipeline","tag-powershell","tag-service","tag-serviceaccount"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/1329","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/comments?post=1329"}],"version-history":[{"count":0,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/1329\/revisions"}],"wp:attachment":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/media?parent=1329"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/categories?post=1329"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/tags?post=1329"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}