How To get Service Logon Accounts with PowerShell

< 1 minute to read

We often needs to list all services, that usually I use Get-Service, unfortunately this command don’t return the service logon account. Of course this can be done with Get-WmiObject using the command below.  The

/**
Get-WmiObject -Class Win32_Service -ComputerName COMPUTERNAME | ? { $_.StartName -match $LogonAccount } | select DisplayName, StartName, State
 */

Win32_Service WMI class represents a service on a computer system running Windows. The ComputerName is not mandatory, only if you want to extrat info for remote computer. The output of Win32_Service is very complex, you can get the PID using ProcessId, description, installed date or DisplayName and many many other util info.

/**
 PS C:\Users\cloudtechadvisor> Get-WmiObject -Class Win32_Service -ComputerName COMPUTERNAME | ? { $_.StartName -match $LogonAccount } | select DisplayName, StartName, State

DisplayName                                              StartName                   State
-----------                                              ---------                   -----
Adobe Acrobat Update Service                             LocalSystem                 Stopped
Adobe Flash Player Update Service                        LocalSystem                 Stopped
AllJoyn Router Service                                   NT AUTHORITY\LocalService   Stopped
Application Layer Gateway Service                        NT AUTHORITY\LocalService   Stopped
Application Identity                                     NT Authority\LocalService   Stopped
Application Information                                  LocalSystem                 Running
Application Management                                   LocalSystem                 Stopped
App Readiness                                            LocalSystem                 Stopped
Microsoft App-V Client                                   LocalSystem                 Stopped
AppX Deployment Service (AppXSVC)                        LocalSystem                 Stopped
AssignedAccessManager Service                            LocalSystem                 Stopped
Windows Audio Endpoint Builder                           LocalSystem                 Running
Windows Audio                                            NT AUTHORITY\LocalService   Running
ActiveX Installer (AxInstSV)                             LocalSystem                 Stopped
BitLocker Drive Encryption Service                       localSystem                 Running
Base Filtering Engine                                    NT AUTHORITY\LocalService   Running
Background Intelligent Transfer Service                  LocalSystem                 Stopped
Background Tasks Infrastructure Service                  LocalSystem                 Running
Computer Browser                                         LocalSystem                 Running
Bluetooth Handsfree Service                              NT AUTHORITY\LocalService   Stopped
Bluetooth Support Service                                NT AUTHORITY\LocalService   Stopped
Capability Access Manager Service                        LocalSystem                 Stopped
SMS Agent Host                                           LocalSystem                 Running
Connected Devices Platform Service                       NT AUTHORITY\LocalService   Running
 */

For additional settings don’t hesitate to Ask a question