Windows: Non standard service accounts (Built-in)

[Daniel_B]

Old name: Services: Non standard accounts (Built-in)

The report below lists all services which were started by accounts other than standard system accounts

The report will only list assets that meet all of the following criteria:

• The asset state is set to "active".
  
• The asset has been successfully scanned at least once.
  
• The asset is a Windows computer.
  
• The asset has service which wasn't started by one of the following: NT AUTHORITY\LocalService, NT AUTHORITY\NetworkService, NT AUTHORITY\Network Service, LocalSystem, NT AUTHORITY\LOCAL SERVICE.
  

Select Top 1000000 tblAssets.AssetID,
  tblAssets.AssetName,
  tblAssets.Domain,
  tblAssets.Username,
  tblAssets.Userdomain,
  Coalesce(tsysOS.Image, tsysAssetTypes.AssetTypeIcon10) As icon,
  tblAssets.IPAddress,
  tsysIPLocations.IPLocation,
  tblAssetCustom.Manufacturer,
  tblAssetCustom.Model,
  tsysOS.OSname As OS,
  tblAssets.SP,
  tblAssets.Lastseen,
  tblAssets.Lasttried,
  tblServicesUni.Name As ServiceName,
  tblServicesUni.Caption As ServiceDisplayName,
  tblServicesUni.Startname
From tblServices
  Inner Join tblAssets On tblServices.AssetID = tblAssets.AssetID
  Inner Join tblServicesUni On tblServices.ServiceuniqueID =
    tblServicesUni.ServiceuniqueID
  Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
  Left Join tsysOS On tblAssets.OScode = tsysOS.OScode
  Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
  Inner Join tsysIPLocations On tsysIPLocations.LocationID =
    tblAssets.LocationID
  Inner Join tblState On tblState.State = tblAssetCustom.State
Where tblServicesUni.Startname <> N'NT AUTHORITY\LocalService' And
  tblServicesUni.Startname <> N'NT AUTHORITY\NetworkService' And
  tblServicesUni.Startname <> N'NT AUTHORITY\Network Service' And
  tblServicesUni.Startname <> N'LocalSystem' And tblServicesUni.Startname <>
  N'NT AUTHORITY\LOCAL SERVICE' And tblState.Statename = 'Active'
Order By tblAssets.Domain,
  tblAssets.AssetName,
  ServiceDisplayName