12

The emphasis of this question is on the second half.

I know how to extract a list of all the services and how to filter on their state. However, what I am unsure how to do is to extract the user account the service is set to "run as".

I don't have the option of using PowerShell (unfortunately) so I'm looking for a native CMD way. I assumed there would be a way to use the sc query command but all that lists is:

SERVICE_NAME
TYPE
STATE
WIN32_EXIT_CODE
SERVICE_EXIT_CODE
CHECKPOINT
WAIT_HINT

FYI - The OS is WIndows 2003 SP2 and I need this information for all of the services so is a long winded process if I have to do it manually for each of them.

19

wmic:
Name and account for all services:
wmic service get name,startname

started services only:
wmic service where started=true get name, startname

services with specific pattern in name:
wmic service where 'name like "%sql%"' get name, startname

nicely formatted as html table (and then opened in your browser):
(wmic service where 'name like "%sql%"' get name, startname /format:htable >out.html) && out.html

Full syntax here: https://msdn.microsoft.com/en-us/library/aa394531%28v=vs.85%29.aspx

  • What's the difference between sc query and wmic? – Pacerier Feb 11 '17 at 14:55
  • 1
    @Pacerier Difference in regards to what? They are just different (cmd line) tools allowing you to query/interact with services; sc is for this purpose only, while wmic is more general (as it allows one to query various parts of the system). wmic is also easier to use for this particular problem (only one query) – wmz Feb 13 '17 at 9:14
5

You can accomplish this in two steps:

  1. Get the list of services:sc \\localhost query | findstr SERVICE_NAME
  2. Your missing piece: sc \\localhost qc + SERVICE_NAME + | findstr SERVICE_START_NAME

I would recommend a batch script like this:

@echo off
setlocal EnableDelayedExpansion
sc \\localhost query | findstr SERVICE_NAME > services.lst
for /f "tokens=1,2" %%A in (services.lst) do (
    echo %%B
    sc \\localhost qc %%B | findstr SERVICE_START_NAME
)
del services.lst

That gives you an output like this: enter image description here

Of course, you can further cleanup that output or write to a CSV file in any manner that you would like.

2

CMD has no native way to do it. SC and NET are built-in applications that come with Windows but that doesn't mean they're native. At any time an admin can remove them and then even CMD is left in the dark.

sc sdshow is what will get you security descriptors, but this will complicate things if you don't know how to read SDDL strings.

Simplest way is to get Sysinternals PsService.exe from Tools package and use it as psservice security [service]. It will list the SDDL in readable format, including account names.

  • What do you mean by "no native way to do it"? Isn't it in C:\Windows\System32\sc.exe for all versions of windows? – Pacerier Feb 11 '17 at 14:57
  • Read again. Built-in means non-removable like CMD. If an admin disables PowerShell, then he can disable sc and net as well. Simplest way is to use a portable app that does all by default and is not tied to the OS. – JasonXA Feb 11 '17 at 17:20
2

Although you can't use PowerShell you should still be able to use VBScript to pull the info from WMI:

Here's a VBS script that will list all services and the account they start as:

strComputer = "."

Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colServices = objWMIService.ExecQuery ("Select * from Win32_Service")

For Each objService in colServices 
    wscript.echo objService.Name & ": " & objService.StartName
Next

Save it and then run it with cscript ScriptName.vbs.

objService.State would give you the service's current state (since you mentioned you're looking to filter by it).

More info on the Win32_Service class.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.