{"id":71463,"date":"2004-09-10T20:25:00","date_gmt":"2004-09-10T20:25:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2004\/09\/10\/how-can-i-tell-which-account-a-service-is-running-under\/"},"modified":"2004-09-10T20:25:00","modified_gmt":"2004-09-10T20:25:00","slug":"how-can-i-tell-which-account-a-service-is-running-under","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/how-can-i-tell-which-account-a-service-is-running-under\/","title":{"rendered":"How Can I Tell Which Account a Service is Running Under?"},"content":{"rendered":"

\"Hey,<\/p>\n

We have services that run under a particular user account. Each time we change the password for that user account, we need to change the password for any services that run under that account as well. But how can we tell which account a service is running under?<\/p>\n

— SA<\/p>\n

\"Spacer\"\"Hey,\"Script<\/a><\/p>\n

Hey, SA. By and large WMI is a pretty transparent technology. To manage services, you use a class named Win32_Service. To manage processes, you use a class named Win32_Process. Not exactly rocket science, right?<\/p>\n

Of course, every now and then WMI throws you a curve, and the service account name happens to be one of those instances. It\u2019s actually easy to determine the account name under which a service runs, provided you know that this information is found using the StartName<\/i> property:<\/p>\n

strComputer = \".\"\nSet objWMIService = GetObject _\n    (\"winmgmts:\\\\\" & strComputer & \"\\root\\cimv2\")\nSet colServices = objWMIService.ExecQuery _\n    (\"Select * From Win32_Service\")\nFor Each objService in colServices\n    Wscript.Echo objService.Name, objService.StartName\nNext\n<\/pre>\n
The preceding code shows you the name and account name for each service installed on a computer. If you only want a list of services running under a specific account (e.g., KenMyer), then use code similar to this:<\/p>\n
strComputer = \".\"\nSet objWMIService = GetObject _\n    (\"winmgmts:\\\\\" & strComputer & \"\\root\\cimv2\")\nSet colServices = objWMIService.ExecQuery _\n    (\"Select * From Win32_Service Where StartName = 'KenMyer'\")\nFor Each objService in colServices\n    Wscript.Echo objService.Name\nNext\n<\/pre>\n
And then how do you change the password using a script? Why, by using a script like this one:<\/p>\n
strComputer = \".\"\nSet objWMIService = GetObject _\n    (\"winmgmts:\\\\\" & strComputer & \"\\root\\cimv2\")\nSet colServices = objWMIService.ExecQuery _\n    (\"Select * From Win32_Service Where StartName = 'KenMyer'\")\nFor Each objService in colServices\n    errReturn = objService.Change( , , , , , , , \"fgT54ghde*&\")\nNext\n<\/pre>\n
Note that when using the Change method, the password is the eighth<\/i> parameter passed. That means you must preface the new password (“fgT54ghde*&”) with seven commas. A bit odd, but it works.<\/p>\n","protected":false},"excerpt":{"rendered":"
We have services that run under a particular user account. Each time we change the password for that user account, we need to change the password for any services that run under that account as well. But how can we tell which account a service is running under? — SA Hey, SA. By and large […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[31,3,4,39,5,6],"class_list":["post-71463","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-operating-system","tag-scripting-guy","tag-scripting-techniques","tag-services","tag-vbscript","tag-wmi"],"acf":[],"blog_post_summary":"
We have services that run under a particular user account. Each time we change the password for that user account, we need to change the password for any services that run under that account as well. But how can we tell which account a service is running under? — SA Hey, SA. By and large […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/71463","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=71463"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/71463\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=71463"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=71463"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=71463"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}