This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(156.8, 79%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM%3C/text%3E%3C/svg%3E)
Hi, how can I list the user account names that a Service is using on a PC?
I am only interested in the the Services that have been configured to run under users accounts, and not the NT Authority or Systems ones etc.
I would like to scan all of our machines. so that I can see what Service and/or Services are using user accounts.
Is this possible.
Thanks
Here you go.
https://devblogs.microsoft.com/scripting/the-scripting-wife-uses-powershell-to-find-service-accounts/
--please don't forget to upvote and Accept as answer if the reply is helpful--
Just checking if there's any progress or updates?
--please don't forget to upvote and Accept as answer if the reply is helpful--
thanks DS,
I was looking for something that could scan a group of pcs in my domain and returns the service accounts that were running under a particular user account.
For example something like this :
AllComputersInDomain = Get-AllComputersInDomain
Get-WmiObject win32_service -AllComputersInDomain | Where-Object {$_.startupname -like “user1”} | Format-Table name,startname,
Is that possible.
Thanks
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 74%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERM%3C/text%3E%3C/svg%3E)
The cmdlet that'll do that "Get-AllComputersInDomain" is called Get-ADComputer. So, something like this:
Get-WmiObject win32_service -ComputerName (Get-ADComputer) |
Where-Object {$_.startupname -like “user1”} |
Format-Table name,startname
Hi Rich,
Yes I need something like that but my PS is not that great.
I will have to try and make something that works.
I think I might have to collect a list and loop through them like DSPatrick mentions below.
Thanks
The Get-WmiObject takes a list of names as an argument for the -ComputerName parameter.
If you want to put the results into an array, and you're only looking for a single user whose name is exactly "user1":
[array]$list = Get-WmiObject win32_service -ComputerName (Get-ADComputer -Filter *) |
Where-Object {$_.startupname -eq "user1"} |
Select-Object name,startupname
. . . and if you have a list of users:
$accts = 'user1','user2','user3'
[array]$list = Get-WmiObject win32_service -ComputerName (Get-ADComputer -Filter *) |
Where-Object {$accts -contains $_.startupname} |
Select-Object name,startname
Hi Rich,
Thanks for that.
I tried using them but I run issues. It threw the following error for all of the machines.
Get-WmiObject : The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)
I suspect that it is Firewall Related or the Service is not turned on for Remote Procedure Call.
Do you encounter the same error if you supply a list of computer name for the -ComputerName parameter (e.g. -ComputerName ws01,ws02,ws03")?
If that works, try changing this line of the script:
[array]$list = Get-WmiObject win32_service -ComputerName (Get-ADComputer -Filter *) |
. . . to this:
[array]$list = Get-WmiObject win32_service -ComputerName (Get-ADComputer -Filter * | Select-Object -Expand Name) |
You'll probably need to build a list of computers then loop through the computer list.
--please don't forget to upvote and Accept as answer if the reply is helpful--