How to search for Services and Scheduled Tasks run as specific user

All organizations should be using service accounts for Specific Tasks and Services, however, some legacy systems might not be. This script will search all servers listed in servers.txt and come back with any results with the username you search

#run this script as administrator
#create a servers.txt for all the servers you want to query
$Servers = Get-Content servers.txt
#add * infront and behind username for wildcard
$user = "*administrator*"

$findings = foreach ($computername in $Servers){

$schtask = schtasks.exe /query /s $computername /V /FO CSV | ConvertFrom-Csv | Where { $_."Run As User" -like $user} | Select TaskName
if ($schtask) {Write-Host "`nTask" + $computername + $schtask }

$displayname = Get-WmiObject -class win32_service -computername $computername |where-object startname -like $user | Select displayname
if ($displayname){Write-Host "`nService" + $computername + $displayname }

}

There’s a free tool with PDQ Inventory for Services

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)
Loading...