Service account usage finder

Good For

• service account dependency discovery

• password rotation planning

• identity cleanup

• pre-retirement configuration evidence

How to Use It

1. Define the exact domain account and in-scope Windows estate before scanning.

2. Collect explicit assignments from Windows services, scheduled tasks, and IIS application pools without changing configuration.

3. Reconcile findings with server/application owners and record where each assignment is expected, stale, or unknown.

4. Treat an empty scan as 'no assignment found in these configuration surfaces,' not as proof that the account is unused.

5. Continue to the Service account retirement evidence workflow for SQL/scripts/stored credentials, SPNs, runtime authentication evidence, observation-window logic, and DISABLE / HOLD / ROLLBACK decisions.

Execution Modes

• local
• remote-single-host
• remote-host-list
• ad-filtered

Inputs and Outputs

Inputs

• service account
• server inventory
• remote read access
• IIS module where applicable

Outputs

• verbose-console
• csv
• operator-notes

Command Starter

$AccountPattern = 'CORP\\svc_legacyapp'
Get-CimInstance Win32_Service | Where-Object { $_.StartName -like "*$AccountPattern*" } | Select-Object PSComputerName,Name,StartName,State
Get-ScheduledTask | ForEach-Object { $Task = $_; if ($Task.Principal.UserId -like "*$AccountPattern*") { [pscustomobject]@{ Type='ScheduledTask'; Name=$Task.TaskName; Path=$Task.TaskPath; Account=$Task.Principal.UserId } } }
Import-Module WebAdministration -ErrorAction SilentlyContinue
Get-ChildItem IIS:\AppPools -ErrorAction SilentlyContinue | ForEach-Object { $Pool = $_; if ($Pool.processModel.userName -like "*$AccountPattern*") { [pscustomobject]@{ Type='IISAppPool'; Name=$Pool.Name; Account=$Pool.processModel.userName } } }

Validation

• All intended Windows targets were queried or failures are visible.

• Every discovered service, task, and IIS assignment is tied to a host and owner/disposition.

• Unreachable or access-denied systems remain visible.

• The result is explicitly handed off to runtime and retirement validation before disablement.

Reporting

• Export discovered assignments plus query failures to the retirement dependency matrix.

• Separate confirmed assignments from unknown/unreachable targets.

• Use the full retirement workflow to make the final disable decision.

Safety Notes

• This script is configuration discovery only and does not prove runtime inactivity.

• Do not disable the account based solely on an empty result.

• Preserve unreachable targets and unknown ownership as unresolved evidence.