Skip to main content

Discover what Accounts Services are Used in Your Network

This week in My Windows Server 2012 class, I had an interesting question pop up while we were discussing managed service accounts. The client knew they needed to switch off of their current service accounts because to many people knew the passwords. They knew managed service accounts were the way to go, but did not know how to address the issue of how to discover all the services that they were using the same accounts on across all of their servers. The client asked me if they could do it with PowerShell….absolutely!
The cmdlet below will allow you to pipe in a comma separated list of your server names and the cmdlet will return all the accounts being used by the services running on the servers in your environment.  I am using the Test-Connection cmdlet in this  code so make sure your servers are able to return pings.

Function Find-ServiceAccounts
{
[cmdletbinding(HelpUri = 'http://get-help-jason-yoder.blogspot.com/2012/11/fins-serviceaccounts.html')]Param (
    [Switch]$AllAccounts,
    [Switch]$Quiet
)   

    # Create a dynamic array to hold all the objects.
    $InitialData = @()

    # Holds a list of all services found.
    $AllServices = @()

    # Final output
    $Output = @()


    # Cycle through each server.
    ForEach($Server in $Input)
    {

        # Display progress data
        If (!$Quiet)
        {
            Write-Host "Check Server $Server : " -NoNewline
        }
        # Add the computer name to the object
        $Obj = New-Object -TypeName PSObject
        $Obj | Add-Member `
            -MemberType NoteProperty `
            -Name "ComputerName" `
            -Value $Server

        # Test to see if it is online.
        If (Test-Connection -Quiet -ComputerName $Server -Count 1)
        {
            # Add the online flag to the object.
            $Obj | Add-Member `
                -MemberType NoteProperty `
                -Name "Online" `
                -Value $True

            # If the $ALLAccounts flag is set, get all services and their
            # logon accounts.  If it is not set, then only retrieve services
            # whose logon accounts ar not "LocalSystem" or "NT AUTHORITY"
            If ($AllAccounts)
            {
                $Services = Invoke-Command -ScriptBlock {
                    Get-WmiObject Win32_Service |
                    Select-Object -Property Name, StartName, __Server} `
                    -ComputerName $Server
            }
            Else
            {
                $Services = Invoke-Command -ScriptBlock {
                    Get-WmiObject Win32_Service |
                    Where-Object {($_.StartName -notlike "*LocalSystem*") `
                    -and ($_.StartName -notlike "*NT AUTHORITY*")}|
                    Select-Object -Property Name, StartName, __Server} `
                    -ComputerName $Server
            }
           
            # Add the Services names to the list of services.
            ForEach ($Service in $Services)
            {
                $AllServices += $Service
            } # End: Add the Services to the object.

            If (!$Quiet)
            {
                Write-Host "Online" `
                    -ForegroundColor Green `
                    -BackgroundColor DarkGreen
            }
        
        } # End: If (Test-Connection -Quiet -ComputerName $Server -Count 1)
        Else
        {
            # Add the offline flag to the object.
            $Obj | Add-Member `
                -MemberType NoteProperty `
                -Name "Online" `
                -Value $False
            
            If (!$Quiet)
            {
                Write-Host "OffLine" `
                    -ForegroundColor Red `
                    -BackgroundColor DarkRed
            }
        }

        $InitialData += $Obj
    } # End: ForEach($Server in $Input)


    # Get a list of all the services names
    $ServiceNames = $AllServices | 
        Select-Object -Property Name -Unique
    


    ForEach ($Server in $InitialData)
    {

        # Build the output objects
        $Obj = New-Object -TypeName PSObject

        # Add the server name and online value.
        $Obj | Add-Member `
            -MemberType NoteProperty `
            -Name "ComputerName" `
            -Value $Server.ComputerName
        $Obj | Add-Member `
            -MemberType NoteProperty `
            -Name "Online" `
            -Value $Server.Online

        ForEach ($Service in $ServiceNames)
        {
            

            # Add a property for each service.
            $Name = $Service.Name
            $Obj | Add-Member `
                -MemberType NoteProperty `
                -Name $Name `
                -Value "N/A"
            
            #Write-Host $Service.Name -ForegroundColor Red
            ForEach ($Item in $AllServices)
            {
                
                   
                If (($Service.Name -eq $Item.name) `
                    -and ($Server.Computername -eq $Item.__Server))
                {
                    $Obj.$Name = $Item.StartName 

                }
                Else
                {
                    
                }
            
            } # End: ForEach ($Item in $InitialData)
            $Output += $Obj
        } # End: ForEach ($Service in $ServiceNames)
        

        $Obj
    }<#
.SYNOPSIS
Discovers all the logon accounts used on service accounts

.DESCRIPTION
Discovers all the services running on a list of servers piped into the
cmdlet and the logon accounts for those services.

The list of servers must be piped in to this cmdlet.


.PARAMETER AllAccounts
Returns services that have logon accounts of LocalServer or NT AUTHORITY.
Without this switch, only services that do not utilize LocalService or
NT AUTHORITY will be returned.

.PARAMETER Quiet
Suppresses the online status display on the monitor.

.EXAMPLE
"Indy1", "Indy2", "Indy3" | Find-ServiceAccounts

Returns the online status of each server, the services running on all servers,
and the service account used for the services logon account ina list format.  
Any service listed as N/A does not exists on that particular server.  Only 
services with a logon account that is not a LocalSystem or NT AUTHORITY
account will be listed.

.EXAMPLE
"Indy1", "Indy2", "Indy3" | Find-ServiceAccounts | FT

Check Server LON-DC1 : Online
Check Server NotOnline : OffLine
Check Server LON-SVR3 : Online

ComputerName  Online BITS           hkmsvc         NcaSvc         Appinfo               
------------  ------ ----           ------         ------         -------              
Indy1         True   .\Webservice$  ADATUM\Acco... ADATUM\Acco... N/A                     
Indy2         False  N/A            N/A            N/A            N/A                     
Indy3         True   N/A            N/A            N/A            ADATUM\Acco... 

Returns the online status of each server, the services running on all servers,
and the service account used for the services logon account.  Any service
listed as N/A does not exists on that particular server.  Only services
with a logon account that is not a LocalSystem or NT AUTHORITY account
will be listed.


.EXAMPLE
"Indy1", "Indy2", "Indy3" | Find-ServiceAccounts -Quiet | FT


ComputerName  Online BITS           hkmsvc         NcaSvc         Appinfo               
------------  ------ ----           ------         ------         -------              
Indy1         True   .\Webservice$  ADATUM\Acco... ADATUM\Acco... N/A                     
Indy2         False  N/A            N/A            N/A            N/A                     
Indy3         True   N/A            N/A            N/A            ADATUM\Acco... 

Returns the online status of each server, the services running on all servers,
and the service account used for the services logon account.  Any service
listed as N/A does not exists on that particular server.  Only services
with a logon account that is not a LocalSystem or NT AUTHORITY account
will be listed.  This example will not display its progress in contacted 
each server.

.EXAMPLE
"Indy1", "Indy2", "Indy3" | Find-ServiceAccounts -AllAccounts | FT

Returns the online status of each server, the services running on all servers,
and the service account used for the services logon account.  Any service
listed as N/A does not exists on that particular server.  

.EXAMPLE
"Indy1", "Indy2", "Indy3" | Find-ServiceAccounts  | Where-Object {$_.Online -eq $True} | Format-table

Check Server LON-DC1 : Online
Check Server NotOnline : OffLine
Check Server LON-SVR3 : Online

ComputerName  Online BITS           hkmsvc         NcaSvc         Appinfo               
------------  ------ ----           ------         ------         -------              
Indy1         True   .\Webservice$  ADATUM\Acco... ADATUM\Acco... N/A                     
Indy2         False  N/A            N/A            N/A            N/A                     
Indy3         True   N/A            N/A            N/A            ADATUM\Acco... 

Returns the services running on all servers that are currently online
and the service account used for the services logon account.  Any service
listed as N/A does not exists on that particular server.  Only services
with a logon account that is not a LocalSystem or NT AUTHORITY account
will be listed.

.NOTES
All servers must be able to return a ping. If the Windows Firewall is
turned on, you must enable inbound firewall rule:
File and Printer Sharing (Echo Request - ICMPv4 -In)

===============================================================================
Copyright 2012 MCTExpert, Inc.
Licensed for use by participants from classes delivered by Jason Yoder.

This script is provided without support, warranty, or guarantee.
User assumes all liability for cmdlet results.
===============================================================================
This code has been tested in a Windows Server 2012 domain.#>
}

Comments

Popular posts from this blog

How to list all the AD LDS instances on a server

AD LDS allows you to provide directory services to applications that are free of the confines of Active Directory.  To list all the AD LDS instances on a server, follow this procedure: Log into the server in question Open a command prompt. Type dsdbutil and press Enter Type List Instances and press Enter . You will receive a list of the instance name, both the LDAP and SSL port numbers, the location of the database, and its status.

How to run GPResult on a remote client with PowerShell

In the past, to run the GPResult command, you would need to either physically visit this client, have the user do it, or use and RDP connection.  In all cases, this will disrupt the user.  First, you need PowerShell remoting enabled on the target machine.  You can do this via Group Policy . Open PowerShell and type this command. Invoke-Command –ScriptBlock {GPResult /r} –ComputerName <ComputerName> Replace <ComputerName> with the name of the target.  Remember, the target needs to be online and accessible to you.

Error icon when creating a GPO Preference drive map

You may not have an error at all.  Take a look at the drive mapping below. The red triangle is what threw us off.  It is not an error.  It is simply a color representation of the Replace option of the Action field in the properties of the drive mappings. Create action This give you a green triangle. The Create action creates a new mapped drive for users. Replace Action The Replace action gives you a red triangle.  This action will delete and recreate mapped drives for users. The net result of the Replace action is to overwrite all existing settings associated with the mapped drive. If the drive mapping does not exist, then the Replace action creates a new drive mapping. Update Action The Update action will have a yellow triangle. Update will modify settings of an existing mapped drive for users. This action differs from Replace in that it only updates settings defined within the preference item. All other settings remain as configured on the mapped drive. If the