MaxBeauchemin
12/10/2018 - 7:24 PM

Identify User Account Usages

Useful for finding those pesky references for your service account

Write-Host "Started at "(get-date)
 
$servers = get-content 'C:\Temp\ServerList.txt'
$accounts = get-content 'C:\Temp\Accounts.txt'

foreach($account in $accounts){
    Write-Host "**********************************"
    Write-Host "Checking account: " $account
    Write-Host "**********************************"
    foreach($server in $servers){
        Write-Host "Checking server: " $server
        gwmi win32_service -filter "startname='$account'" -computer $server | select __SERVER,Name,startname
        Write-Host "----------------------------------------"
    }
}
 
Write-Host "Completed at "(get-date)



##Scheduled Tasks

Write-Host "Started at "(get-date)
 
$servers = get-content 'C:\Temp\ServerList.txt'
$accounts = get-content 'C:\Temp\Accounts_SchedTasks.txt'
 
foreach($account in $accounts){
    Write-Host "**********************************"
    Write-Host "Checking account: " $account
    Write-Host "**********************************"
    foreach($server in $servers){
        Write-Host "Checking server: " $server
        
        $schtask = schtasks.exe /query /s $server  /V /FO CSV | ConvertFrom-Csv
 
        if ($schtask)
        {
            foreach ($sch in $schtask)
            {
                if ($sch."Run As User" -match "$($account)")
                {
                    Write-Host  $sch.TaskName "     " $server "    " $account
                }
            }
        }
        Write-Host "----------------------------------------"
    }
}
 
Write-Host "Completed at "(get-date)