Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Need to change the domain administrator account password. Is there a PS script or tool that can check all servers in the domain to see where this account is being used to run services?

Thx,

share|improve this question
4  
It's really a bad idea to have anything running as the built-in Administrator account. If you do find anything, strongly consider changing it. –  MDMarra Dec 3 '12 at 19:00

2 Answers 2

Now is a good time to stop running services as the domain admin account.

Import-Module ActiveDirectory
Foreach ($comp in Get-ADComputer -Filter *)
{
  $services = Get-WMIObject win32_service -Computername $comp
  Foreach($svc in $services)
  {
     If($svc.StartName -eq "DOMAIN\Administrator" -or $svc.StartName -eq "Administrator@DOMAIN")
     {
         Write-Error "THE $svc.Name SERVICE ON $comp IS RUNNING AS DOMAIN ADMIN"
     }
  }

}

Something along those lines. Assuming you run the script with sufficient credentials, and you have network connectivity and firewall access and such to every computer from the place where you run the script, it should run through all the computers in your domain, get all the services for each computer, and alert when it finds one that is running as the domain admin. Modify to suit your needs.

Edit: If for some reason you can't do that, you might get some decent information by trawling the Security event logs on all your domain controllers, looking for logons by the domain administrator account and the computer that they're coming from.

share|improve this answer
    
Thanks! Agreed, just inherited this domain... :) –  user147079 Dec 3 '12 at 19:09

I have tested a few ways, such as sc.exe, cmdlet, C#, the first time the service can not start. The error message is "log on failure". Manually put in the password in the service and click the OK button in the prompt dialog. The service can be start up.

Later on, delete the service, change account and change password, the methods I listed above will work.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.