Is there a way to identify services running uner a particular userID?

  • Thread starter Thread starter Cappy
  • Start date Start date
C

Cappy

Hello!

We have approx 400 servers that have a piece of software on them. Most of
the boxes have the two services associated w/ this software running as, or
logging on as, a domain account. Poking around in the services of a few
servers, there are other services that are also running as this domain
account.

The password for this domain account will be changing on Friday night. So
we'll need to push the new password to the services.

Question: Is there a way to query all of the servers to find out which
services are running as this account? I was playing w/ sc.exe and it
doesn't appear to be able to show us the "log on as" setting. Could be I'm
not using the correct flags...

Will sc.exe work to push the new password out to the services? Or is there
another command line executable that will work better?

Thanks for any input...

Cappy
 
Try the following script. This is a modified version of a script I use to
restart SQL Server instances in remote servers.

To use it, open a command prompt and type "cscript <script name>.vbs
/c:<remote computername>" without the quotation marks. The script will then
echo the service name and the username specified for it.

I know this is too much work to do manually if you have 400 servers, but
what you can then do is modify the script to get computer names (server
names) from a database and then post the results back to a database; just
use ADO and SQL server or a MS Access database.

Remember that the script must be run under the context of a user account
with admin rights over the server being queried, or otherwise granted access
using the WMI Control applet in Computer Management. You can use runas
/netonly to run the script with other credentials, or you can put the
credentials inside the script in the line

Set oServer = oLocator.ConnectServer(strComputerName, , , , , , 128)

If you need information on how to use WMI, I recommend that you visit
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnanchor/html/anch_wmi.asp.

Also, specific information on the Win32_Service class can be found here:
http://msdn.microsoft.com/library/en-us/wmisdk/wmi/win32_service.asp.

'[============= VBScript Source File =============]
'
' APPLICATION: WebSoftware HotHTML 3 Professional v1.0.2280
' DATE: 3/17/2006
' TIME: 10:58:17 PM
' VERSION: 1.0.1
' LAST MODIFIED: 2006-05-15
'
' COMMENTS:
'
' Command-line switches:
' *?|help
' *c:<server name>
'[===============================================]

Option Explicit

'Command-line Switches:
'======================
Private Const c_strPHelp1 = "?"
Private Const c_strPHelp2 = "help"
Private Const c_strPComputerName = "c"

'Value separator
Private Const c_strSep = ":"
'Quotation marks replacement
Private Const c_strQuoteRep = "'"

'SplitArg:
'Splits an argument in parameter and value.
'Parameters:
' *strArg: Argument to split
'Return values:
' *Array(<parameter>, <value>)
Private Function SplitArg(strArg)

Dim arrTemp
Dim strParam
Dim strValue
Dim lCount

arrTemp = Split(strArg, c_strSep)
If ((UBound(arrTemp) - LBound(arrTemp) + 1) > 1) Then
'Re-concatenate the value if it had ":" in between
strValue = ""
For lCount = LBound(arrTemp) + 1 To UBound(arrTemp)
If (Len(strValue) > 0) Then
strValue = strValue & c_strSep
End If
strValue = strValue & arrTemp(lCount)
Next
strValue = Replace(strValue, c_strQuoteRep, """")
Else
strValue = ""
End If
strParam = arrTemp(LBound(arrTemp))
'Strip the "/" or the "-" from the parameter
If (Left(strParam, 1) = "/") Or (Left(strParam, 1) = "-") Then
strParam = Mid(strParam, 2)
End If
SplitArg = Array(strParam, strValue)
End Function

'ShowHelp:
'Procedure that echoes the help for this script
Private Sub ShowHelp()

Dim strHelp

strHelp = UCase(WScript.ScriptName) & vbCrLf
strHelp = strHelp & String(Len(WScript.ScriptName), "=") & vbCrLf
strHelp = strHelp & "Restarts all SQL Server instances in the local
computer or a remote server if " _
& vbCrLf & "the services are set for automatic startup and their current
state is not " _
& vbCrLf & "running." _
& vbCrLf & vbCrLf & "Use the following command-line switches:" & vbCrLf &
vbCrLf _
& "-" & c_strPHelp1 & "|" & c_strPHelp2 & vbCrlf _
& " Shows this help." & vbCrLf _
& "-" & c_strPComputerName & c_strSep & "<server name>" & vbCrLf _
& " Specify the server the script should connect to." _
& vbCrLf & vbCrLf & "IMPORTANT: The script uses the credentials of the
logged-on user. If the " _
& vbCrLf & "current username is not part of the domain, or otherwise does
not have " _
& vbCrLf & "administrative rights to the server, then use the runas
command with the " _
& vbCrLf & "appropriate network credentials."
WScript.Echo strHelp
End Sub

'Main execution body
'===================

Dim oLocator
Dim oServer
Dim colServices
Dim oService
Dim colArgs
Dim oArg
Dim arrArg
Dim strComputerName

strComputerName = "." 'Local computer
For Each oArg In WScript.Arguments
arrArg = SplitArg(oArg)
Select Case arrArg(LBound(arrArg))
Case c_strPHelp1, c_strPHelp2
ShowHelp
WScript.Quit
Case c_strPComputerName
strComputerName = arrArg(UBound(arrArg))
End Select
Next
Set oLocator = CreateObject("WbemScripting.SWbemLocator")
Set oServer = oLocator.ConnectServer(strComputerName, , , , , , 128)
Set colServices = oServer.InstancesOf("Win32_Service")
WScript.Echo "Found " & CStr(colServices.Count) & " services."
For Each oService In colServices
WScript.Echo oService.DisplayName & " -- " & oService.StartName
Next
Set oService = Nothing
Set colServices = Nothing
WScript.Quit
 
Hello!

We have approx 400 servers that have a piece of software on them. Most of
the boxes have the two services associated w/ this software running as, or
logging on as, a domain account. Poking around in the services of a few
servers, there are other services that are also running as this domain
account.

The password for this domain account will be changing on Friday night. So
we'll need to push the new password to the services.

Question: Is there a way to query all of the servers to find out which
services are running as this account? I was playing w/ sc.exe and it
doesn't appear to be able to show us the "log on as" setting. Could be I'm
not using the correct flags...

Will sc.exe work to push the new password out to the services? Or is there
another command line executable that will work better?

Thanks for any input...

Cappy
See tip 9045 » How can I generate a CSV (Comma Separated Value) file of services and the account they run under?
in the 'Tips & Tricks' at http://www.jsifaq.com

See tip 5721 » Report all services on servers in your domain that match a specified context.

Jerold Schulman
Windows Server MVP
JSI, Inc.
http://www.jsiinc.com
http://www.jsifaq.com
 
Cappy,

If you are able to use PowerShell you could adapt the following:

$Computers = "Machine1", "Machine2", "Machine3"
foreach ($i in $Computers)
{get-wmiobject Win32_Service -ComputerName $i |
where-object {$_.StartName -eq "NT Authority\NetworkService" } |
format-table $i, Name, StartName}

Andrew Watt MVP
Author - Professional Windows PowerShell (Wrox)
 
Back
Top