Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose an old administrator left the organization. He left no documentation, and had many things set up "his way", while ignoring best practice.

I want to delete his account, though this will likely break many valid services (this is how he had it set up).

How would I search the network (or AD) to locate any services running under a particular user account?

Must I log into each server and check its services?

share|improve this question
up vote 1 down vote accepted

You can review the security log on your Domain Controllers after he's gone and his account should no longer be in active use. Look for successful account logons for his account and what machine(s) they're coming from.

share|improve this answer
Great- thank you. – Matt Jan 21 '13 at 20:39

You could do something like

foreach($comp in Get-ADComputer)
    if($(gwmi win32_service -Computername $comp).StartName -eq "DudeWhoLeft")
share|improve this answer
Thanks! I will be sure to give this a go first before I try the manual solution. – Matt Jan 21 '13 at 20:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.