The 2011 Scripting Games Beginner Event 4: Use PowerShell to Find Accounts Used by Services

2011 Scripting Games badge

Summary: Beginner Event 4 of the 2011 Scripting Games uses Windows PowerShell to find accounts that are used by services.

About this event



Date of Event

4/7/2011 12:01 AM

Due Date

4/14/2011 12:01 AM

Event scenario

You are the network administrator for a medium-sized, single-site company. You are responsible for 50 servers that are running a combination of Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2. All of the servers have Windows PowerShell 2.0 installed on them, and Windows PowerShell remoting is enabled. A recent security audit discovered a few services that are not configured to use standard service accounts. Instead, some of the services are using custom service accounts with custom permissions. Because your corporate security plan requires that all services use standard service accounts, your boss has tasked you with writing a Windows PowerShell script that reports all services that are using non-standard accounts. A sample output is shown in the following image.

Design points

  • You do not need to worry about the start mode of the service. Even if a service is disabled, if it uses a non-standard service account it should be reported.
  • You do not need to worry about if the service is running, paused, or stopped. If the service uses a non-standard service account, it should be reported.
  • Standard service accounts are:
    • LocalSystem
    • NT Authority\LocalService
    • NT Authority\NetworkService

2011 Scripting Games links

2011 Scripting Games: All Links on One Page

Submit your scripts on PoshCode

Support our Sponsors!

I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at, or post your questions on the Official Scripting Guys Forum. Good luck as you compete in this year’s Scripting Games. We wish you well.

Ed Wilson, Microsoft Scripting Guy

Comments (12)

  1. mredwilson says:

    @FP @Brad Call Script formatting seems to be lost when using Internet Explorer. However, I have been told that copy and paste works fine for some other browsers. However, there is a download script button on PoshCode that I generally use, I then open it in notepad, and paste it into the PowerShell ISE … this preserves all formatting. You can also double-click inside the code and it will copy as well. Formatting is not an issue.

  2. mredwilson says:

    @JD yes, the picture is bad, and scrolled to the "wrong" portion of the output. You want to display all services that are not using the standard services.

    @Brad the judges all have jobs and are volunteers. Grading for Event 1 is not due until Monday. Also some comments have been lost by the PoshCode tool. The first priority is to grade all the scripts, comments are optional but desired. There are lots of scripts to grade, and only 30 judges. However, I did email the judges yesterday and asked them to add comments if they can … esp. if giving a 1 star score. Generally a 1 star means the script did not run when the judge tested it. This has been the case with MANY of the scripts I tested that needed admin rights to run. I have added this comment to all of my grades … if a script runs with admin rights, then I give it two stars. Two means the script runs AND meets all of the minimum requirements. Therefore if a script runs, but does not meet all of the minimum requirements it will still get a 1 star. Again, I have been noting this for the scripts I graded. See the judging criteria … linked from the All in one page…/2011-scripting-games-all-links-on-one-page.aspx

    @KloinerF See the judges criteria from the all in one page to see how the points total up.

  3. mredwilson says:

    @Gabe, yes this is the 4th one but there will be 10. 5 more next week on Mon-Friday.

  4. Anonymous says:

    Sweet, I can start fresh on this one after some sleep.  This is 4th one of five total?

  5. mredwilson says:

    @SMassey By default this is for the local computer. You can certainly add the capability for a remote computer, or process a list of servers from AD or a text file and gather extra points. Also you will get extra points for adding comment based help, use of functions, and anything else you can think of.

  6. JD says:

    I am a bit confused by the task. It states write "a Windows PowerShell script that reports all services that are using non-standard accounts" yet the sample output is clearly showing LocalSystem – a standard account. Also do you want it run against all servers or should it be able to be used locally or remotely?

  7. Brad Call says:

    Seriously judges if you are going to give a crappy 1 start for a script that does everything being asked I need some comments… I feel like I wasting my time

  8. kloinerF says:


    it would be cool to know what else you want, how the point sum up, maybe someone can clarify it 😉

    beeing a systemsadministrator, everything is good that works 😉

  9. FP says:

    My scripts were working as expected as a non admin account, still I got only a star and no comment on two of them.

    I did notice that if I copy cut from poshcode the text formating was lost, in other words all the text was on the same line event if when displayed on the web page it was formated properly.

    Since the first line was a comment this made my script a whole comment stuff.

    I did reformat what I copied to match what was displayed and the script still work as expected.

    I suspect that maybe some judge got trick by that, do they have acces to the download option you usualy have in the poshcode web site interface? If as I do only have acces to the copy cut stuff that would explain the issue.

  10. Brad Call says:

    FP:  I just tested that to and had the same resualt. if I copy and pasted the text from the web page the formatting went all crayz and did not work, but if I used the download option everything was good

  11. SMassey says:

    Is this supposed to be for the local computer, a remote computer, or process a list of servers from AD or a text file?  Is that something that is up to the author's discretion?

Skip to main content