Client Management Suite

Team,

Can we find a report from Altiris server from which we can know that which services being started by which user AD ID.

Because many user’s starting and stopping server’s services. Please provide me solution. 

Hi,

Please check this.

select

vc.Name [Computer Name]

,vc.[OS Name]

,svc.Name [Service Name]

,svc.Description

,svc.StartupType

,svc.LogonAs

from vComputer vc

join Inv_AeX_AC_NT_Services svc on svc._ResourceGuid = vc.Guid

where vc.[OS Name] like '%server%'

and svc.LogonAs not in

('LocalSystem',

'NT AUTHORITY\LocalService',

'NT AUTHORITY\NetworkService',

'NT AUTHORITY\NETWORK SERVICE',

'NT AUTHORITY\LOCAL SERVICE'

)

Are you trying to find out what user account a Windows service is configured to use (the Logon As value)?  Or are you asking what user is manually stopping and starting services.  For the first item, the report Ambesh provided should help.  If the second item, that would require analyzing the security logs.  I'm not aware of any option to pull that information into Altiris, other than perhaps Monitor Solution but I'm not an expert on that product.  

Hello dst_admin,

Any update on this. or you are looking for more help.