nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Powershell to the Rescue!

the_Grinch

Today prior to my arrival I saw an email from one of our customers (nice guy, but sucked big time that he passed this request to us) asking that we go onto all of his servers and see if any services were setup to run under his account. I knew the minute that email came in they were going to pass it off on me (yay nightshift). So I come in early for our quarterly meeting and one of the senior engineers comes over to make sure I understood what I needed to do. I said yeah and confirmed this wasn't something that had to be done yesterday. He said nah and that I could take a couple of days to finish since this customer has 25 servers. So after the meeting I kept thinking there had to be a way to automate it so I didn't have to manually go through each service and check them. Thus off to the magical Google and I started looking at various Powershell commands, after about an hour of piecing things together and testing on my PC I had a working script! Two hours later (I had to email some of the files to myself since my local drive was mounting properly on a lot of the servers) and I was pretty much down. They have three 2003 servers without Powershell so I'll have to figure that one out. Anyhow, the script will grab all the services, give you a status, and let you know what account it is using to run. It then exports it neatly into a CSV for your consumption. Figured it might help someone out...

Get-WmiObject Win32_Service | Sort-Object ServiceType | Select-Object Name, Status, StartName | Export-CSV "C:\Users\<username>\Desktop\Services.csv"

Find more posts tagged with

SAVE $250 on Your Boot Camp — Use Code "EXAM26"

Exclusively for TechExams members for Infosec Boot Camps starting before April 30, 2026

View Boot Camps

Comments

effekted

I've done a bit of batch scripting at work and some bash scripting from hackingdojo, powershell and perl is what I want to mess with next.

More and more I see people talking about it on here makes me want to learn it even more...but must keep focus and keep on trucking for my CCNA lol.

undomiel

Don't forget to check the script repository thread here!

http://www.techexams.net/forums/off-topic/59688-script-repository-2.html#post565416

You don't need powershell installed on all of their servers to run your script since it is just using WMI queries. You only need it on one machine on their network to run it from.

vCole

undomiel wrote: »

Don't forget to check the script repository thread here!

http://www.techexams.net/forums/off-topic/59688-script-repository-2.html#post565416

You don't need powershell installed on all of their servers to run your script since it is just using WMI queries. You only need it on one machine on their network to run it from.

Beat me to it! PowerShell makes a sys admin's work so much easier.

Everyone

undomiel wrote: »

Don't forget to check the script repository thread here!

http://www.techexams.net/forums/off-topic/59688-script-repository-2.html#post565416

You don't need powershell installed on all of their servers to run your script since it is just using WMI queries. You only need it on one machine on their network to run it from.

As a side note, installing PowerShell on a 2003 server does NOT require a reboot. I've installed it on dozens of production servers in the middle of the day without issue.

Everyone

Also, you could improve your script and easily run it against all 25 servers by adding a ForEach statement. Make a text file with 1 server name per line in it, and use the Get-Content command in a variable to feed the ForEach command. You could also tell it to ONLY show you services that are running under an account. Something like this...

$data = Get-Content C:\Scripts\ServerList.txt
ForEach ($line in $data)
{
Get-WmiObject Win32_Service -ComputerName $line | Where {$_.StartName -NotLike "*Local*" -and $_.StartName -NotLike "*Network*"} | Select Name,StartName | Export-CSV "C:\Scripts\$line.Services.csv"
}

So in my example above there, you would get a list of all services on all servers that are NOT running as NT Authority\LocalService, NT Authority\NetworkService or LocalSystem.

the_Grinch

Everyone that is awesome! Thanks for that, it actually makes me want to learn Powershell as I am sure some of the automation could really come in handy. It just so happens that later in the night I was able to locate a vbs script that did the same thing and I ran it on the three 2003 boxes. Wish I have known I could have fun it remotely as that would have saved me so trouble. Thanks again!

Chivalry1

Powershell is a great tool...Microsoft hit a home run with this one. I use it daily!!! Before .vbs and kickstart is what I was using within the windows world.