documentation<\/a>. The most useful information is how to achieve a \"not like\" filter. Ideally, I want a WMI query to filter out all the service accounts that start with NT Authority as well as LocalSystem. This should leave me with \"regular\" user accounts.So here's a simple one liner to do just that:<\/p>\n[cc lang=\"PowerShell\"]
\nPS C:\\> get-wmiobject win32_service -filter \"(StartName Like '[^NT Authority]%') AND (StartName <> 'localsystem')\" | Select name,Startname<\/p>\n
name Startname
\n---- ---------
\nMSSQL$SQLEXPRESS .\\sql
\nVeeam Backup and FastSCP Service .\\Jeff
\n[\/cc]<\/p>\n
These accounts are local to the machine. <\/p>\n
Remember that a WMI query uses legacy operators, not the PowerShell ones. And having WMI do the filtering is more efficient than bringing everything back to your computer and piping to Where-Object. You would really notice this when you start querying multiple remote machines. Use the SystemName property here to include the computer name.<\/p>\n
But now you can run a simple expression to scan computers and find where non system accounts are being used. This will only work for computers running Windows XP and later.<\/p>\n","protected":false},"excerpt":{"rendered":"
As easy as Get-Service is to use in PowerShell, it has one limitation for IT Pros: it can’t show you what account the service is running under. In old school terms, “What is the service account?” Fortunately you can get that information using WMI. Here’s a query you can use that takes advantage of some…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[75,19],"tags":[534,304,547],"class_list":["post-1551","post","type-post","status-publish","format-standard","hentry","category-powershell-v2-0","category-wmi","tag-powershell","tag-service","tag-wmi"],"yoast_head":"\n
Find Non System Service Accounts with PowerShell and WMI • The Lonely Administrator<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Find Non System Service Accounts with PowerShell and WMI • The Lonely Administrator\" \/>\n<meta property=\"og:description\" content=\"As easy as Get-Service is to use in PowerShell, it has one limitation for IT Pros: it can't show you what account the service is running under. In old school terms, "What is the service account?" Fortunately you can get that information using WMI. Here's a query you can use that takes advantage of some...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/\" \/>\n<meta property=\"og:site_name\" content=\"The Lonely Administrator\" \/>\n<meta property=\"article:published_time\" content=\"2011-07-05T13:51:50+00:00\" \/>\n<meta name=\"author\" content=\"Jeffery Hicks\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@JeffHicks\" \/>\n<meta name=\"twitter:site\" content=\"@JeffHicks\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jeffery Hicks\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/wmi\\\/1551\\\/find-non-system-service-accounts-with-powershell-and-wmi\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/wmi\\\/1551\\\/find-non-system-service-accounts-with-powershell-and-wmi\\\/\"},\"author\":{\"name\":\"Jeffery Hicks\",\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/#\\\/schema\\\/person\\\/d0258030b41f07fd745f4078bdf5b6c9\"},\"headline\":\"Find Non System Service Accounts with PowerShell and WMI\",\"datePublished\":\"2011-07-05T13:51:50+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/wmi\\\/1551\\\/find-non-system-service-accounts-with-powershell-and-wmi\\\/\"},\"wordCount\":332,\"commentCount\":5,\"publisher\":{\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/#\\\/schema\\\/person\\\/d0258030b41f07fd745f4078bdf5b6c9\"},\"keywords\":[\"PowerShell\",\"Service\",\"WMI\"],\"articleSection\":[\"PowerShell v2.0\",\"WMI\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/wmi\\\/1551\\\/find-non-system-service-accounts-with-powershell-and-wmi\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/wmi\\\/1551\\\/find-non-system-service-accounts-with-powershell-and-wmi\\\/\",\"url\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/wmi\\\/1551\\\/find-non-system-service-accounts-with-powershell-and-wmi\\\/\",\"name\":\"Find Non System Service Accounts with PowerShell and WMI • The Lonely Administrator\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/#website\"},\"datePublished\":\"2011-07-05T13:51:50+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/wmi\\\/1551\\\/find-non-system-service-accounts-with-powershell-and-wmi\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/wmi\\\/1551\\\/find-non-system-service-accounts-with-powershell-and-wmi\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/wmi\\\/1551\\\/find-non-system-service-accounts-with-powershell-and-wmi\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"PowerShell v2.0\",\"item\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/category\\\/powershell-v2-0\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Find Non System Service Accounts with PowerShell and WMI\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/\",\"name\":\"The Lonely Administrator\",\"description\":\"Practical Advice for the Automating IT Pro\",\"publisher\":{\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/#\\\/schema\\\/person\\\/d0258030b41f07fd745f4078bdf5b6c9\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/#\\\/schema\\\/person\\\/d0258030b41f07fd745f4078bdf5b6c9\",\"name\":\"Jeffery Hicks\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg\",\"caption\":\"Jeffery Hicks\"},\"logo\":{\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Find Non System Service Accounts with PowerShell and WMI • The Lonely Administrator","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/","og_locale":"en_US","og_type":"article","og_title":"Find Non System Service Accounts with PowerShell and WMI • The Lonely Administrator","og_description":"As easy as Get-Service is to use in PowerShell, it has one limitation for IT Pros: it can't show you what account the service is running under. In old school terms, \"What is the service account?\" Fortunately you can get that information using WMI. Here's a query you can use that takes advantage of some...","og_url":"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/","og_site_name":"The Lonely Administrator","article_published_time":"2011-07-05T13:51:50+00:00","author":"Jeffery Hicks","twitter_card":"summary_large_image","twitter_creator":"@JeffHicks","twitter_site":"@JeffHicks","twitter_misc":{"Written by":"Jeffery Hicks","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/#article","isPartOf":{"@id":"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/"},"author":{"name":"Jeffery Hicks","@id":"https:\/\/jdhitsolutions.com\/blog\/#\/schema\/person\/d0258030b41f07fd745f4078bdf5b6c9"},"headline":"Find Non System Service Accounts with PowerShell and WMI","datePublished":"2011-07-05T13:51:50+00:00","mainEntityOfPage":{"@id":"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/"},"wordCount":332,"commentCount":5,"publisher":{"@id":"https:\/\/jdhitsolutions.com\/blog\/#\/schema\/person\/d0258030b41f07fd745f4078bdf5b6c9"},"keywords":["PowerShell","Service","WMI"],"articleSection":["PowerShell v2.0","WMI"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/","url":"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/","name":"Find Non System Service Accounts with PowerShell and WMI • The Lonely Administrator","isPartOf":{"@id":"https:\/\/jdhitsolutions.com\/blog\/#website"},"datePublished":"2011-07-05T13:51:50+00:00","breadcrumb":{"@id":"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"PowerShell v2.0","item":"https:\/\/jdhitsolutions.com\/blog\/category\/powershell-v2-0\/"},{"@type":"ListItem","position":2,"name":"Find Non System Service Accounts with PowerShell and WMI"}]},{"@type":"WebSite","@id":"https:\/\/jdhitsolutions.com\/blog\/#website","url":"https:\/\/jdhitsolutions.com\/blog\/","name":"The Lonely Administrator","description":"Practical Advice for the Automating IT Pro","publisher":{"@id":"https:\/\/jdhitsolutions.com\/blog\/#\/schema\/person\/d0258030b41f07fd745f4078bdf5b6c9"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jdhitsolutions.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/jdhitsolutions.com\/blog\/#\/schema\/person\/d0258030b41f07fd745f4078bdf5b6c9","name":"Jeffery Hicks","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg","url":"https:\/\/secure.gravatar.com\/avatar\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg","caption":"Jeffery Hicks"},"logo":{"@id":"https:\/\/secure.gravatar.com\/avatar\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg"}}]}},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"jetpack-related-posts":[{"id":1625,"url":"https:\/\/jdhitsolutions.com\/blog\/powershell\/1625\/get-process-owner\/","url_meta":{"origin":1551,"position":0},"title":"Get Process Owner","author":"Jeffery Hicks","date":"August 25, 2011","format":false,"excerpt":"I've been working on my second training course for Train Signal on managing Windows Server 2008 with Windows PowerShell, specifically the lesson on managing processes. I thought I'd share a little tidbit I worked out. In fact, I hope you'll stay tuned for other little goodies over the next several\u2026","rel":"","context":"In "PowerShell"","block_context":{"text":"PowerShell","link":"https:\/\/jdhitsolutions.com\/blog\/category\/powershell\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":100,"url":"https:\/\/jdhitsolutions.com\/blog\/powershell\/100\/more-with-service-uptime\/","url_meta":{"origin":1551,"position":1},"title":"More with Service Uptime","author":"Jeffery Hicks","date":"February 16, 2007","format":false,"excerpt":"I knew I wasn't totally satisfied with my recent attempt at listing service uptime. I knew there was a more elegant solution and here it is: $s=Get-WmiObject -query \"Select name,processId,state from Win32_service where state='running'\"foreach ($item in $s) {$p=(Get-Process | Where {$_.id -eq $item.ProcessID}).StartTime$u=(get-date).Subtract($p)Write-Host $item.Name `t $u.Days day $u.hours hours $u.minutes\u2026","rel":"","context":"In "PowerShell"","block_context":{"text":"PowerShell","link":"https:\/\/jdhitsolutions.com\/blog\/category\/powershell\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":103,"url":"https:\/\/jdhitsolutions.com\/blog\/powershell\/103\/more-with-process-and-service-uptime\/","url_meta":{"origin":1551,"position":2},"title":"More with Process and Service uptime","author":"Jeffery Hicks","date":"February 20, 2007","format":false,"excerpt":"Like most things scripting, there's usually more than one way to do things. I thought I had a nice solution for getting service uptime via WMI. But alas, there is an even easier way. PowerShell has a ConvertToDateTime method which will convert a WMI time to a standard date time\u2026","rel":"","context":"In "PowerShell"","block_context":{"text":"PowerShell","link":"https:\/\/jdhitsolutions.com\/blog\/category\/powershell\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":8143,"url":"https:\/\/jdhitsolutions.com\/blog\/powershell\/8143\/solving-the-powershell-memory-challenge\/","url_meta":{"origin":1551,"position":3},"title":"Solving the PowerShell Memory Challenge","author":"Jeffery Hicks","date":"February 8, 2021","format":false,"excerpt":"I hope you tried your hand at this Iron Scripter PowerShell challenge on reporting memory usage. The basic challenge was to find the total percent of working set memory that a specific process or service is using. Here's how I approached it, with my usual disclaimer that my solution is\u2026","rel":"","context":"In "PowerShell"","block_context":{"text":"PowerShell","link":"https:\/\/jdhitsolutions.com\/blog\/category\/powershell\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2021\/02\/get-wspct.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2021\/02\/get-wspct.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2021\/02\/get-wspct.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2021\/02\/get-wspct.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2021\/02\/get-wspct.png?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2021\/02\/get-wspct.png?resize=1400%2C800&ssl=1 4x"},"classes":[]},{"id":14,"url":"https:\/\/jdhitsolutions.com\/blog\/scripting\/14\/finding-service-uptime\/","url_meta":{"origin":1551,"position":4},"title":"Finding Service Uptime","author":"Jeffery Hicks","date":"January 10, 2006","format":false,"excerpt":"Ever wonder how long a particular service has been running? With WMI you can come pretty close to getting a handle on this. We start with Win32_Service to get the current process handle. Once we have that, we can query the Win32_Process class and get the creation time for that\u2026","rel":"","context":"In "Scripting"","block_context":{"text":"Scripting","link":"https:\/\/jdhitsolutions.com\/blog\/category\/scripting\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":515,"url":"https:\/\/jdhitsolutions.com\/blog\/powershell\/515\/find-that-service\/","url_meta":{"origin":1551,"position":5},"title":"Find That Service","author":"Jeffery Hicks","date":"November 19, 2009","format":false,"excerpt":"Once again, the fine forum members at ScriptingAnswers.com come through and help get my PowerShell idea engine revving. The latest post posed this basic question: \u201cI need to query my servers and find all services using a specific service account.\u201d The poster thought this would be a good opportunity to\u2026","rel":"","context":"In "CommandLine"","block_context":{"text":"CommandLine","link":"https:\/\/jdhitsolutions.com\/blog\/category\/commandline\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"_links":{"self":[{"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/1551","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=1551"}],"version-history":[{"count":0,"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/1551\/revisions"}],"wp:attachment":[{"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=1551"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=1551"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=1551"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}