Discovery - Retrieve the local accounts on windows server.

[CharanpreetK]

Has anyone worked on retrieving the local accounts from windows server. The accounts are non-human accounts which might be in active directory or created locally on the server to execute services for third party apps or local services on the servers. The accounts needs to be retrieved from windows server and not from active directory.

[Pratiksha]

You can write an extension to windows server patter, use run command operation. You can google the commands and if works then create a table and insert it as related information. 

[Ram Devanathan1]

nice idea - can you log an idea for this in ideas portal @CharanpreetK 

go to support.servicenow.com/ideas

let's start with thinking about how a pattern can first retrieve these.

i want to know a little more about your use-case. can we discuss?

pl email me at ram<at>servicenow<dot>com 

Ram

Director, ITOM products

[CharanpreetK · Accepted solution]

Hi Ram,

The use case is to retrieve the accounts (local and non-human) on the windows server and populate in one of the CMDB table, to be specific, below are the accounts to be retrieved.

1. Accounts executing window services(available as OOB Window-services probe ) - solved.

2. Accounts executing scheduled tasks - I created an extension on windows OS servers pattern with the Parse command output step using the command - "powershell.exe Get-ScheduledTask -TaskPath \ ^| Export-ScheduledTask"

3. Accounts running IIS application pools - there is OOB probe, getIIS information, however it does not provide the runasaccount information - need to cutomize the probe or extend the pattern to retrieve the account executing IIS Application pool

@Ram Devanathan1  I will be submitting this on the idea portal as it seems to be a good to have feature and can be achieved through powershell or Win32 classes.

Thanks,

Charanpreet

[doug_schulze]

I did this in a probe sensor way back in the day.  So as other suggestions say, you can create a table for them to reside in, referenced back to the compute record and populate the returns.  I did it through a powershell script at the time but can be refactored in a pattern extension...

launchProcess -computer $computer -cred $cred -command 'net localgroup administrators' | where {$_ -AND $_ -notmatch "command completed successfully"} | select -skip 4