{"id":3564,"date":"2018-08-14T23:38:36","date_gmt":"2018-08-14T23:38:36","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=3564"},"modified":"2022-12-02T02:31:53","modified_gmt":"2022-12-02T02:31:53","slug":"how-to-search-for-services-and-scheduled-tasks-run-as-specific-user","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/code\/how-to-search-for-services-and-scheduled-tasks-run-as-specific-user","title":{"rendered":"How to search for Services and Scheduled Tasks run as specific user"},"content":{"rendered":"\n
All organizations should be using service accounts for Specific Tasks and Services, however, some legacy systems might not be. This script will search all servers listed in servers.txt and come back with any results with the username you search<\/p>\n\n\n\n
<\/p>\n\n\n
\n\t
#run this script as administrator#create a servers.txt for all the servers you want to query$Servers = Get-Content servers.txt#add * infront and behind username for wildcard$user = "*administrator*"$findings = foreach ($computername in $Servers){ $schtask = schtasks.exe \/query \/s $computername \/V \/FO CSV | ConvertFrom-Csv | Where { $_."Run As User" -like $user} | Select TaskName if ($schtask) {Write-Host "`nTask" + $computername + $schtask } $displayname = Get-WmiObject -class win32_service -computername $computername |where-object startname -like $user | Select displayname if ($displayname){Write-Host "`nService" + $computername + $displayname }}<\/code><\/pre>