How Can I Tell Which Account a Service is Running Under?

How Can I Tell Which Account a Service is Running Under?

  • Comments 2
  • Likes
Hey, Scripting Guy! Question

We have services that run under a particular user account. Each time we change the password for that user account, we need to change the password for any services that run under that account as well. But how can we tell which account a service is running under?

-- SA

SpacerHey, Scripting Guy! AnswerScript Center

Hey, SA. By and large WMI is a pretty transparent technology. To manage services, you use a class named Win32_Service. To manage processes, you use a class named Win32_Process. Not exactly rocket science, right?

Of course, every now and then WMI throws you a curve, and the service account name happens to be one of those instances. It’s actually easy to determine the account name under which a service runs, provided you know that this information is found using the StartName property:

strComputer = "."
Set objWMIService = GetObject _
    ("winmgmts:\\" & strComputer & "\root\cimv2")
Set colServices = objWMIService.ExecQuery _
    ("Select * From Win32_Service")
For Each objService in colServices
    Wscript.Echo objService.Name, objService.StartName
Next

The preceding code shows you the name and account name for each service installed on a computer. If you only want a list of services running under a specific account (e.g., KenMyer), then use code similar to this:

strComputer = "."
Set objWMIService = GetObject _
    ("winmgmts:\\" & strComputer & "\root\cimv2")
Set colServices = objWMIService.ExecQuery _
    ("Select * From Win32_Service Where StartName = 'KenMyer'")
For Each objService in colServices
    Wscript.Echo objService.Name
Next

And then how do you change the password using a script? Why, by using a script like this one:

strComputer = "."
Set objWMIService = GetObject _
    ("winmgmts:\\" & strComputer & "\root\cimv2")
Set colServices = objWMIService.ExecQuery _
    ("Select * From Win32_Service Where StartName = 'KenMyer'")
For Each objService in colServices
    errReturn = objService.Change( , , , , , , , "fgT54ghde*&")  
Next

Note that when using the Change method, the password is the eighth parameter passed. That means you must preface the new password ("fgT54ghde*&") with seven commas. A bit odd, but it works.

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment
  • Instead of an explicit password, try:

        strInput = InputBox( "Enter new password: " )  'strInput becomes password

        . . .

        errReturn = objService.Change( , , , , , , , strInput)  ' change password

        errReturn = objService.StopService()                    ' stop service

        errReturn = objService.StartService()                   ' start service again

  • @Alan This particular article was written almost exactly 7 years ago :-) and it was not written by me. However, I do like your suggestion to use an input box for the password, rather than manually hardcoding the password into the script. One problem is the password is plaintext in the input box. Using Windows Powershell, there is a Get-Credential cmdlet that will encrypt the password ... but your suggestion is a good improvement on this script.