Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a number of domain service accounts that are running with more privileges than they need and I need to reduce their permissions and change all of their passwords.

How can I audit all of the places where a domain service account is used throughout my company?

share|improve this question

This is pretty tricky to do. The most effective way is to parse the Security event-log on every domained machine looking for logins by that domain service account. Once you've identified which machines have seen logins you can then hunt up services that may be configured to use them. Parsing event-logs is something you'll want to script unless you have only a few machines.

Unfortunately, Win XP doesn't come with the security log turned on by default (I believe).

Personally I'd run the script from Window Vista/7 or Server 2008. There is a much improved tool for grabbing event-log data, wevtutil. You can filter for logon events (4624) and dump things in XML for easier parsing.

wevtutil qe Security /r:$MachineName /q:"*[System[(EventID=4624)]" > $MachineName-Events.xml

Doing your Domain Controllers first will at least tell you what IP addresses logins are coming from, but doing the entire domain is the only way to be 100% certain.

share|improve this answer
+1 - I agree in principle. Since the service account is a domain account, though, you should be able to concentrate your efforts on the Security Event Logs of Domain Controller computers, rather than every domain member computer. When the service account performs a logon on a domain member computer that will result in a logon event being processed by a domain controller (when the LSA on the domain member checks in w/ the DC to authenticate the user, get the user's group membership list, etc). – Evan Anderson Oct 21 '10 at 21:24
@Evan I realized that after I got done digging out the wevtutil syntax. :} – sysadmin1138 Oct 21 '10 at 21:28

Searching the Security event log is only going to be useful if logon events are being audited, which I don't believe is enabled by default. You'll need to enable auditing in the Default Domain policy in order to turn on auditing on yor non-DC servers (unless you have an OU and GPO specifically for your servers and you're blocking inheritance or setting the GPO to enforced, then you'll need to edit the applicable GPO). In addition to that, services configured to use domain accounts will be logged in that servers Security log when those services start, not the DC's Security log.

A service configured to use a domain user account will generate an Event ID 528 in the Security event log with Logon Type 5 when the service is started so you can filter the Security event log for Event ID 528 events to narrow the results.

I just verified this in my own environment (I think I did, based on my tests) so I believe this information is correct.

Another item to look at would be the Scheduled Tasks on each server and see if any of them are configured to use any of the service accounts. If so, you'll need to change the passwords on the Scheduled Tasks as well.

share|improve this answer

To expand on @joeqwerty, I think you sould do better to do an audit of the services and scheduled tasks on all the machines that you care about to see what credentials they use. I'm sure WMI exposes that info, so you could do this with VBS or PowerShell with a few lines and then just run it remotely against your list of machines.

Turning on auditing and trawling through all the event logs seems like more work.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.