windows 用于更改服务帐户的 Powershell 脚本

Powershell script to change service account

提问by Jesse Weigert

Does anyone have a Powershell script to change the credentials used by a Windows service?

有没有人有一个 Powershell 脚本来更改 Windows 服务使用的凭据？

回答by Don Jones

Bit easier - use WMI.

稍微简单一点 - 使用 WMI。

$service = gwmi win32_service -computer [computername] -filter "name='whatever'"
$service.change($null,$null,$null,$null,$null,$null,$null,"P@ssw0rd")

Change the service name appropriately in the filter; set the remote computer name appropriately.

在过滤器中适当更改服务名称；适当地设置远程计算机名称。

回答by Chris N

I wrote a function for PowerShell that changes the username, password, and restarts a service on a remote computer (you can use localhost if you want to change the local server). I've used this for monthly service account password resets on hundreds of servers.

我为 PowerShell 编写了一个函数，用于更改用户名、密码并重新启动远程计算机上的服务（如果要更改本地服务器，可以使用 localhost）。我已经将它用于数百台服务器上的每月服务帐户密码重置。

You can find a copy of the original at http://www.send4help.net/change-remote-windows-service-credentials-password-powershel-495

您可以在http://www.send4help.net/change-remote-windows-service-credentials-password-powershel-495找到原始副本

It also waits until the service is fully stopped to try to start it again, unlike one of the other answers.

与其他答案之一不同，它还会等到服务完全停止以尝试再次启动它。

Function Set-ServiceAcctCreds([string]$strCompName,[string]$strServiceName,[string]$newAcct,[string]$newPass){
  $filter = 'Name=' + "'" + $strServiceName + "'" + ''
  $service = Get-WMIObject -ComputerName $strCompName -namespace "root\cimv2" -class Win32_Service -Filter $filter
  $service.Change($null,$null,$null,$null,$null,$null,$newAcct,$newPass)
  $service.StopService()
  while ($service.Started){
    sleep 2
    $service = Get-WMIObject -ComputerName $strCompName -namespace "root\cimv2" -class Win32_Service -Filter $filter
  }
  $service.StartService()
}

回答by AndyM

I created a text file "changeserviceaccount.ps1" containing the following script:

我创建了一个包含以下脚本的文本文件“changeserviceaccount.ps1”：

$account="domain\user"
$password="passsword"
$service="name='servicename'"

$svc=gwmi win32_service -filter $service
$svc.StopService()
$svc.change($null,$null,$null,$null,$null,$null,$account,$password,$null,$null,$null)
$svc.StartService()

I used this as part of by post-build command line during the development of a windows service:

在 Windows 服务的开发过程中，我使用它作为构建后命令行的一部分：

Visual Studio: Project properties\Build Events

Visual Studio：项目属性\生成事件

Pre-build event command line:

预构建事件命令行：

"C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\installutil.exe" myservice.exe /u

Post-build event command line:

构建后事件命令行：

"C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\installutil.exe" myservice.exe
powershell -command - < c:\psscripts\changeserviceaccount.ps1

回答by Lockszmith

The PowerShell 6 version of Set-Servicenow has the -Credentialparameter.

现在的 PowerShell 6 版本Set-Service具有该-Credential参数。

Here is an example:

下面是一个例子：

$creds = Get-Credential
Set-Service -DisplayName "Remote Registry" -Credential $creds

At this point, it is only available via download via GitHub.

此时，它只能通过GitHub下载。

Enjoy!

享受！

回答by grenade

A slight variation on the other scripts here, is below. This one will set credentials for any/all services running under a given login account. It will only attempt to restart the service if it was already running, so that we don't accidentally start a service that was stopped for a reason. The script has to be run from and elevated shell (if the script starts telling you about ReturnValue = 2, you're probably running it un-elevated). Some usage examples are:

此处其他脚本的细微变化如下。这将为在给定登录帐户下运行的任何/所有服务设置凭据。如果服务已经在运行，它只会尝试重新启动服务，这样我们就不会意外启动因某种原因停止的服务。脚本必须从提升的 shell 运行（如果脚本开始告诉你关于ReturnValue = 2，你可能正在运行它未提升）。一些使用示例是：

• all services running as the currently logged in user, on the local host:

  .\set-servicecredentials.ps1 -password p@ssw0rd

• all services running as user: somedomain\someuseron host somehost.somedomain:

  .\set-servicecredentials.ps1 somehost.somedomain somedomain\someuser p@ssw0rd

• 在本地主机上以当前登录用户身份运行的所有服务：

  .\set-servicecredentials.ps1 -password p@ssw0rd

• 以用户身份运行的所有服务：somedomain\someuser在主机上somehost.somedomain：

  .\set-servicecredentials.ps1 somehost.somedomain somedomain\someuser p@ssw0rd

Set-ServiceCredentials.ps1:

设置ServiceCredentials.ps1：

param (
  [alias('computer', 'c')]
  [string] $computerName = $env:COMPUTERNAME,

  [alias('username', 'u')]
  [string] $serviceUsername = "$env:USERDOMAIN$env:USERNAME",

  [alias('password', 'p')]
  [parameter(mandatory=$true)]
  [string] $servicePassword
)
Invoke-Command -ComputerName $computerName -Script {
  param(
    [string] $computerName,
    [string] $serviceUsername,
    [string] $servicePassword
  )
  Get-WmiObject -ComputerName $computerName -Namespace root\cimv2 -Class Win32_Service | Where-Object { $_.StartName -eq $serviceUsername } | ForEach-Object {
    Write-Host ("Setting credentials for service: {0} (username: {1}), on host: {2}." -f $_.Name, $serviceUsername, $computerName)
    $change = $_.Change($null, $null, $null, $null, $null, $null, $serviceUsername, $servicePassword).ReturnValue
    if ($change -eq 0) {
      Write-Host ("Service Change() request accepted.")
      if ($_.Started) {
        $serviceName = $_.Name
        Write-Host ("Restarting service: {0}, on host: {1}, to implement credential change." -f $serviceName, $computerName)
        $stop = ($_.StopService()).ReturnValue
        if ($stop -eq 0) {
          Write-Host -NoNewline ("StopService() request accepted. Awaiting 'stopped' status.")
          while ((Get-WmiObject -ComputerName $computerName -Namespace root\cimv2 -Class Win32_Service -Filter "Name='$serviceName'").Started) {
            Start-Sleep -s 2
            Write-Host -NoNewline "."
          }
          Write-Host "."
          $start = $_.StartService().ReturnValue
          if ($start -eq 0) {
            Write-Host ("StartService() request accepted.")
          } else {
            Write-Host ("Failed to start service. ReturnValue was '{0}'. See: http://msdn.microsoft.com/en-us/library/aa393660(v=vs.85).aspx" -f $start) -ForegroundColor "red"
          }
        } else {
          Write-Host ("Failed to stop service. ReturnValue was '{0}'. See: http://msdn.microsoft.com/en-us/library/aa393673(v=vs.85).aspx" -f $stop) -ForegroundColor "red"
        }
      }
    } else {
      Write-Host ("Failed to change service credentials. ReturnValue was '{0}'. See: http://msdn.microsoft.com/en-us/library/aa384901(v=vs.85).aspx" -f $change) -ForegroundColor "red"
    }
  }
} -Credential "$env:USERDOMAIN$env:USERNAME" -ArgumentList $computerName, $serviceUsername, $servicePassword

回答by VonC

Considering that whithin this class:

考虑到这个类：

$class=[WMICLASS]'\.\root\Microsoft\SqlServer\ComputerManagement:SqlService'

there's a method named setserviceaccount(), may be this scriptwill do what you want:

有一个名为 的方法setserviceaccount()，这个脚本可能会做你想做的事：

# Copyright Buck Woody, 2007
# All scripts provided AS-IS. No functionality is guaranteed in any way.
# Change Service Account name and password using PowerShell and WMI
$class = Get-WmiObject -computername "SQLVM03-QF59YPW" -namespace
root\Microsoft\SqlServer\ComputerManagement -class SqlService

#This remmed out part shows the services - I'll just go after number 6 (SQL
#Server Agent in my case):
# foreach ($classname in $class) {write-host $classname.DisplayName}
# $class[6].DisplayName
stop-service -displayName $class[6].DisplayName

# Note: I recommend you make these parameters, so that you don't store
# passwords. At your own risk here!
$class[6].SetServiceAccount("account", "password")
start-service -displayName $class[6].DisplayName

回答by MoonStom

What I cannot find in the default PS stack, I find it implemented in Carbon:

我在默认 PS 堆栈中找不到的东西，我发现它在Carbon以下位置实现：

http://get-carbon.org/help/Install-Service.html

http://get-carbon.org/help/Install-Service.html

http://get-carbon.org/help/Carbon_Service.html(Carbon 2.0 only)

http://get-carbon.org/help/Carbon_Service.html（仅限碳 2.0）

回答by Syed Waqas

The given answers do the job.

给出的答案可以完成工作。

Although, there is another important detail; in order to change the credentials and run the service successfully, you first have to grant that user account permissions to 'Log on as a Service'.

不过，还有一个重要的细节；为了更改凭据并成功运行服务，您首先必须授予该用户帐户权限以“作为服务登录”。

To grant that privilege to a user, use the Powershell script provided hereby just providing the username of the account and then run the other commands to update the credentials for a service as mentioned in the other answers, i.e.,

要向用户授予该权限，请使用此处提供的 Powershell 脚本，只需提供帐户的用户名，然后运行其他命令来更新其他答案中提到的服务的凭据，即，

$svc=gwmi win32_service -filter 'Service Name'

$svc.change($null,$null,$null,$null,$null,$null,'.\username','password',$null,$null,$null)

回答by js2010

Sc config example. First allowing modify access to a certain target folder, then using the locked down "local service" account. I would use set-service -credential, if I had PS 6 or above everywhere.

Sc 配置示例。首先允许修改访问某个目标文件夹，然后使用锁定的“本地服务”帐户。如果我到处都有 PS 6 或更高版本，我会使用 set-service -credential。

icacls c:\users\myuser\appdata\roaming\fahclient /grant "local service:(OI)(CI)(M)"
sc config "FAHClient" obj="NT AUTHORITY\LocalService"