I used several WMI queries in Windows8.1x64 on wbemtest.exe to attempt finding out which user started a particular service. The ones that got me "this far" are presented here. I know that if I query the win32_service object like:

select * from win32_service where name like '%SERVICENAME%'

I obtain only one result (the service I'm looking for), then I double click it to browse the service properties, and found out there's a property called "StartName" which shows the name of the user that started it (that's what I want).

Now, the problem begins when I do:

 select StartName from win32_service where name like '%SERVICENAME%'

I get Win32_Service = <no key>

Even without the where clause it shows the same. (But for all local services)

What am I missing to make it work properly?

  • Try something like Get-WmiObject win32_service -Property * | % { 'service:' + $_.Name + ' startas: ' + $_.StartName } in powershell? – Zoredache Jan 10 '14 at 18:11
  • This works well, but since I'm planning to implement the query on a windows form app in C# I cannot depend on powershell to do so. Thanks anyway :) – safejrz Jan 10 '14 at 18:28
  • Why not? Anyway see: stackoverflow.com/questions/18280977/… – Zoredache Jan 10 '14 at 19:00
  • There's nothing to stop you doing a WMI query in C#! – arco444 Jan 10 '14 at 19:29
  • I know this will work for Windows 7 and newer OS that include it but, my app has to be supported in Windows XP too (yes I know, that sucks), but in that case, Will this still work without requiring my users to download/install any extra msi's, runtimes, etc? – safejrz Jan 10 '14 at 20:32

That property is not who started it, but who it should start as i.e. the account it will run under.

I think the best bet for you here is the event log, though I think it will only show you services that entered stopped and started states by default.

The service will typically run under SYSTEM or NETWORK SERVICE or other system account, so even if you find the executable process, this won't contain the answer.

In short, this is tricky. I think you may need to look into the auditing features in Windows. The fact that it is a service means that usually it will be the system that starts it rather than a user anyway.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.