HOWTO: Find All Service Accounts Used on PCs


A lot of data breaches start with attacks on privileged service accounts. An important step in proactively locking the security of your corporate network is to find all service accounts.

Action1 is a free Cloud-based Endpoint Security Platform. Among hundreds of other built-in features, it allows to find all service accounts used on endpoints. After the discovery is done, you can manage service account passwords and perform other maintenance operations. This article explains how to list Exchange service accounts using Action1 to find service accounts in domain Windows server 2008 r2 or other operating systems and also shows how to list service accounts from command line for organizations that are not able to utilize Action1 in their environments.



Manually:

1. Execute WMI Query in ROOT\CIMV2 Namespace:

   - Launch WMI Explorer or any other tool which can run WMI queries.
   - Run WMI query: SELECT * FROM Win32_Service

2. Open WMIC Command-line Interface:

   - Press WIN+R
   - Type "wmic", press Enter
   - In wmic command line tool type: /node:RemoteComputerName service

3. Run This Simple Windows Powershell Script:

   - thru WMI object: Get-WmiObject -Namespace ROOT\CIMV2 -Class Win32_Service -Computer RemoteComputerName

4. Use Following Code to Select Specific Columns:

   - execute: Get-WmiObject -Namespace ROOT\CIMV2 -Class Win32_Service -Computer RemoteComputerName | Select-Object DisplayName, Started, StartMode, StartName, PSComputerName

5. Sort the Results Using the Line Below:

   - invoke command: Get-WmiObject -Namespace ROOT\CIMV2 -Class Win32_Service -Computer RemoteComputerName | Select-Object DisplayName, Started, StartMode, StartName, PSComputerName | Sort-Object DisplayName

6. The Next Code Helps to Filter Results:

   - use it: Get-WmiObject -Namespace ROOT\CIMV2 -Class Win32_Service -Computer RemoteComputerName | Select-Object DisplayName, Started, StartMode, StartName, PSComputerName | Where-Object -FilterScript {$_.DisplayName -like "*SQL Server*"}

7. Save Results to CSV File:

   - run: Get-WmiObject -Namespace ROOT\CIMV2 -Class Win32_Service -Computer RemoteComputerName | Select-Object DisplayName, Started, StartMode, StartName, PSComputerName | Export-CSV "c:\file.csv" -Append -NoTypeInformation

8. The Next Step Is to Query Multiple Computers:

   - computers from a text file: Get-Content -Path c:\computers.txt | ForEach-Object {Get-WmiObject -Namespace ROOT\CIMV2 -Class Win32_Service -Computer $_}
   - computers from AD domain: Get-ADComputer -Filter {OperatingSystem -Like 'Windows 10*'} | ForEach-Object {Get-WmiObject -Namespace ROOT\CIMV2 -Class Win32_Service -Computer $_.Name}

With Action1 Endpoint Security Platform:

Step 1 - Sign-up for Free:

Step 2 - Type Your Question in Plain English:

Action1 allows to find all  service accounts used on multiple endpoints or manage service account passwords and perform maintenance operations. - search query

Step 3 - Set Filters, If Necessary:

Action1 allows to find all  service accounts used on multiple endpoints or manage service account passwords and perform maintenance operations. - set filters

Step 4 - See Results from All Endpoints in Seconds:

Endpoint NameDisplay NameStartedUser NameState
mac.widgets.localSQL ServerTrueWIDGETS\sql1Running
fred.widgets.localMS ExchangeTrueWIDGETSxchRunning
ray.widgets.localFile BackupFalseWIDGETS\b1Stopped

Do not have time to write scripts? Check out Action1 Endpoint Security Platform. Ask questions in plain English such as "list of installed software" or "all running processes".
Get answers instantly from live systems or subscribe to real-time alerts:


When exposed, privileged service accounts can substantially widen your network’s cyberattack surface. A very common typical set-it-and-forget-it service account management practice of never changing service account passwords can lead to major data breaches and other security incidents. According to many security best practices and standards, it’s recommended to change accounts passwords every 90 to 180 days. This can become a very tedious task, if you have hundreds of systems each running a few services and don’t have a good documentation about account usage (which is most organizations don’t have, unfortunately). Most recent versions of Windows also have a concept of managed service accounts, however their adoption by a lot of organizations has yet to be seen and the it’s quite complicated. With that being said, one practical way of managing service account security is to continuously maintain an inventory of all services across your corporate network, which domain accounts they use (non-built-in accounts) and change their passwords from time to time. And don’t forget to update the account information in service settings, to avoid service account login failures.


Other Relevant HOWTOs: