Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Suppose an old administrator left the organization. He left no documentation, and had many things set up "his way", while ignoring best practice.

I want to delete his account, though this will likely break many valid services (this is how he had it set up).

How would I search the network (or AD) to locate any services running under a particular user account?

Must I log into each server and check its services?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

You can review the security log on your Domain Controllers after he's gone and his account should no longer be in active use. Look for successful account logons for his account and what machine(s) they're coming from.

share|improve this answer
    
Great- thank you. –  Matt Jan 21 '13 at 20:39

You could do something like

foreach($comp in Get-ADComputer)
{
    if($(gwmi win32_service -Computername $comp).StartName -eq "DudeWhoLeft")
    {
         Write-Host "I FOUND A SERVICE ON $comp THAT RUNS AS DUDEWHOLEFT!!!"
    }
}
share|improve this answer
    
Thanks! I will be sure to give this a go first before I try the manual solution. –  Matt Jan 21 '13 at 20:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.