RE: Discovering Active Direcory shared or Service users account

Here's a quick way to find non-standard service accounts that are
actually used:

Loop through each computer with the following command, replacing %1 with
the name of the computer.

C:\>wmic /node:%1 service where (not StartName like "LocalSystem" and
not StartName like "%%NetworkService%%" and not StartName like
"%%LocalService%%") get Name, Caption, StartMode, StartName, Started

This might be more effective because, as James noted, service accounts
look just like regular user accounts in Active Directory.

There might be better ways other than this.

Scott

-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com]
On Behalf Of Biassoni Riccardo
Sent: Tuesday, April 03, 2007 7:25 AM
To: focus-ms@securityfocus.com
Subject: Discovering Active Direcory shared or Service users account

Hi All,

Is there a way to discover Active Directory "Shared" user account or
"Service" users Account for auditing purpose? 
I have domain admin privileges and local access to my domain
controllers.

Best regards
Tich