Query remote servers Windows Services Logon As information.

Question

_{Wednesday, June 5, 2019 8:51 PM}

We want to decommission a domain service account. We want to make sure there is no window service on the domain member servers running using that service account.  

May someone advice some PS commands to remotely query Windows services and LOGON AS information?  

I have tried the below but it does not work.  Please advise.  Thanks.

$server = Get-Content -path C:\Servers.txt
$server | foreach { (Get-Service -computername $_) |Select-Object Status, Name, DisplayName, MachineName, logonas } | Export-csv -Path C:\Services on remote servers.csv

All replies (10)

_{Wednesday, June 5, 2019 9:03 PM}

Hello,

By using your favorite search engine, you can find many provided solutions for this.

Here's a previous post which is similar to yours:
find where a service account is being used.

You can also refer to the blog post below:
PowerShell: Get-ServiceAccountUsage

Best regards,
Leon

Blog: https://thesystemcenterblog.com LinkedIn:

_{Wednesday, June 5, 2019 9:56 PM}

There is no such property as "logonas"

Get-WmiObject win32_service |Select-Object Status, Name, DisplayName, pscomputername, Startname

\(ツ)_/

_{Thursday, June 6, 2019 2:37 PM}

This command returns result of what I need:

Get-WmiObject -computername remote-server win32_service |Select-Object Status, Name, DisplayName, pscomputername, Startname | export-csv C:\result.csv

When I do this for other servers, I am getting a RPC error.  Any idea?

import-csv "C:\servers.csv" | ForEach-Object {
$Server = $_."Servers"
Get-WmiObject -computername $Server win32_service |Select-Object Status, Name, DisplayName, pscomputername, Startname | export-csv C:\result.csv
}

Get-WmiObject : The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)
At line:3 char:1

• Get-WmiObject -computername $Server win32_service |Select-Object Stat ...

    + CategoryInfo          : InvalidOperation: (:) [Get-WmiObject], COMException
    + FullyQualifiedErrorId : GetWMICOMException,Microsoft.PowerShell.Commands.GetWmiObjectCommand

_{Thursday, June 6, 2019 2:50 PM}

RPC server is unavailable error means your Windows computer have a problem with communicating with other devices or machines through the network you use, this could be caused by for example a firewall.

Make sure the Remote Procedure Call (RPC) service is running on the destination computer, if it is running, it's likely a firewall blocking the connection.

Blog: https://thesystemcenterblog.com LinkedIn:

_{Thursday, June 6, 2019 3:03 PM}

I open up firewall.cpl on that remote server, the firewall is turned of.  I even shut the firewall windows services, same RPC error occurs when I run the script:

Get-WmiObject -computername my-remote-server win32_service |Select-Object Status, Name, DisplayName, pscomputername, Startname | export-csv C:\result.csv

Any other "trick" I could try or test?

Thanks. 

_{Thursday, June 6, 2019 3:12 PM}

You need to fix WMI on the remote server. 

\(ツ)_/

_{Thursday, June 6, 2019 3:26 PM}

There are sooooooo many reasons for that 0x800706ba error code being returned! You might as well consider it as the "OMG! Something's wrong! I give up. YOU figure it out" error.

Try searching for "windows check rpc connectivity" and you'll find some useful Powershell scripts to help eliminate some of the problems. The "portqry" software is pretty useful, too.

The problem may be on the local machine, or on the remote machine. It may be a service that's not running. It may be a misconfigured registry. It may be a name resolution problem (try using a FQDN or IP address in place of the remote machine's NetBIOS name). It may be a network problem. Etc. Etc. Etc.

Rich Matheisen MCSE&I, Exchange Ex-MVP (16 years)

_{Thursday, June 6, 2019 3:32 PM}

WMIDiag does all of that and more:

https://www.microsoft.com/en-us/download/details.aspx?id=7684

\(ツ)_/

_{Thursday, June 6, 2019 3:36 PM}

firewall is off on the remote server.  Only the firewall windows service is running.  Without that, I will not even be able to remote into the server.  

The remote server is pingable, and IP address is correct.  TCPIP/NETBIOS HELPER service is running.  RPC is running.  WMI service is running.  

I have no idea of what else could be missing...

_{Friday, July 5, 2019 2:09 AM}

Hi,

Was your issue resolved?

If you resolved it using our solution, please "mark it as answer" to help other community members find the helpful reply quickly.

If you resolve it using your own solution, please share your experience and solution here. It will be very beneficial for other community members who have similar questions.

If no, please reply and tell us the current situation in order to provide further help.

Best Regards,

Lee

Just do it.