Looking for a way to enumerate all places a domain account is used 1

[ITAAGuyOR]

I am looking for a tool or a way to enumerate all places (or instances) that an account may be being used on the network. This is a Windows 2003 domain environment in 2003 forest functional level. The reason I am looking for this is that I have an account from someone who has left the company and I need to know all places that account may still be being used, I.E. (any services etc. that account is still running on all servers in the domain). If anyone knows of any way to do this with VBScript, a windows tool, third party add-on or whatever I would be grateful.

-Thanks

 

[crobin1]

Try this VBScript. It requires a file called servers.txt, which is simply a listing of each server you want to check, one name per line, i.e.:
SERVER1
SERVER2

Dim objFSO
Dim objLogFile
Dim objSL 'File containing the server list
Dim objWMIService
Dim colListOfServices
dim ts

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objLogFile = objFSO.CreateTextFile("service_list.txt", True)
Set objSL = objFSO.GetFile("servers.txt")

Set ts = objSL.OpenAsTextStream(1)

'Use the pipe character [ | ] as the delimiter because some of the
'descriptions include commas
objLogFile.Write _
    ("System Name|Service Name|Service Type|Service State|Caption|" _ 
        & "Description|Display Name|Executable Path|Service Started|" _ 
        & "Start Mode|Account Name")
objLogFile.Writeline

Do While Not ts.AtEndOfStream
   strComputer = ts.Readline
   Set objWMIService = GetObject("winmgmts:" _
     & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
   Set colListOfServices = objWMIService.ExecQuery _
        ("Select * from Win32_Service")
   For Each objService in colListOfServices
    objLogFile.Write objService.SystemName & "|" 
    objLogFile.Write objService.Name & "|" 
    objLogFile.Write objService.ServiceType & "|" 
    objLogFile.Write objService.State & "|" 
    objLogFile.Write objService.Caption & "|" 
    objLogFile.Write objService.Description & "|" 
    objLogFile.Write objService.DisplayName & "|" 
    objLogFile.Write objService.PathName & "|" 
    objLogFile.Write objService.Started & "|" 
    objLogFile.Write objService.StartMode & "|" 
    objLogFile.Write objService.StartName & "|" 
    objLogFile.writeline
   Next
Loop

ts.Close
objLogFile.Close

Set objFSO = Nothing
Set objLogFile = Nothing
Set objWMIService = Nothing
Set colListOfServices = Nothing
Set ts = Nothing
Set strComputer = Nothing

Wscript.Echo "Finished"

 

[ITAAGuyOR]

Crobin,

I am debugging that example now. When I run it I get this error:

FINDSERVICESBYUSER.VBS(24, 4) Microsoft VBScript runtime error: The remote server machine does not exist or is
unavailable: 'GetObject'

 

[markdmac]

Sounds like you either have a bad server name in your list of servers or you are not logged on with Admin rights for the WMI impersonation to work.

I hope you find this post helpful.

Regards,

Mark

 

[ITAAGuyOR]

I tracked it down to an errant WMI service failing to load on one of the servers in the list. This stopped the script from continuing. I fixed WMI on the server and all is well now. Thanks for this very helpful script. It is exactly what I needed. I just love WMI and VBScript!