{"id":3564,"date":"2018-08-14T23:38:36","date_gmt":"2018-08-14T23:38:36","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=3564"},"modified":"2022-12-02T02:31:53","modified_gmt":"2022-12-02T02:31:53","slug":"how-to-search-for-services-and-scheduled-tasks-run-as-specific-user","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/code\/how-to-search-for-services-and-scheduled-tasks-run-as-specific-user","title":{"rendered":"How to search for Services and Scheduled Tasks run as specific user"},"content":{"rendered":"\n<p>All organizations should be using service accounts for Specific Tasks and Services, however, some legacy systems might not be. This script will search all servers listed in servers.txt and come back with any results with the username you search<\/p>\n\n\n\n<p><\/p>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-markup code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-markup code-embed-code\">#run this script as administrator<br\/>#create a servers.txt for all the servers you want to query<br\/>$Servers = Get-Content servers.txt<br\/>#add * infront and behind username for wildcard<br\/>$user = &quot;*administrator*&quot;<br\/><br\/>$findings = foreach ($computername in $Servers){<br\/><br\/>    $schtask = schtasks.exe \/query \/s $computername \/V \/FO CSV | ConvertFrom-Csv | Where { $_.&quot;Run As User&quot; -like $user} | Select TaskName<br\/>    if ($schtask) {Write-Host &quot;`nTask&quot; + $computername + $schtask }<br\/>   <br\/>    $displayname = Get-WmiObject -class win32_service -computername $computername |where-object startname -like $user | Select displayname<br\/>    if ($displayname){Write-Host &quot;`nService&quot; + $computername + $displayname }<br\/>   <br\/>}<\/code><\/pre> <div class=\"code-embed-infos\"> <a href=\"https:\/\/github.com\/pariswells\/pariswells.com\/blob\/master\/searchServicesandTasksforUser.ps1\" title=\"See searchServicesandTasksforUser.ps1\" target=\"_blank\" class=\"code-embed-name\">searchServicesandTasksforUser.ps1<\/a> <a href=\"https:\/\/raw.github.com\/pariswells\/pariswells.com\/master\/searchServicesandTasksforUser.ps1\" title=\"Back to searchServicesandTasksforUser.ps1\" class=\"code-embed-raw\" target=\"_blank\">view raw<\/a> <\/div> <\/div><\/div>\n\n\n\n<p><a href=\"https:\/\/www.pdq.com\/blog\/finding-windows-services-running-under-certain-accounts\/\">There\u2019s a free tool with PDQ Inventory for Services<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>All organizations should be using service accounts for Specific Tasks and Services, however, some legacy systems might not be. This script will search all servers listed in [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[320],"tags":[2629,2628,2626,2625,576,2627,2624,2623,2492],"class_list":["post-3564","post","type-post","status-publish","format-standard","hentry","category-code","tag-find-all-scheduled-tasks-running-under-account","tag-find-all-services-running-under-account","tag-find-users","tag-log-on-type","tag-powershell","tag-query-all-servers","tag-scheduled-tasks","tag-services","tag-windows"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/3564","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/comments?post=3564"}],"version-history":[{"count":3,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/3564\/revisions"}],"predecessor-version":[{"id":6447,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/3564\/revisions\/6447"}],"wp:attachment":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/media?parent=3564"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/categories?post=3564"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/tags?post=3564"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}