07 September, 2011

How to read the account name running a Windows Service

I today had to find a way on how to retrieve the account name used for running a (Windows) service on a Windows 7 PC. This actually proved more difficult than first expected – as I did not know where this information is stored in the first place. But, as the value is resurrected at boot of the machine, it must be stored somewhere persistently!

I learned this: All values are stored in Registry at this location (see image)


As evident from the figure – all relevant values are stored here and can be retrieved (readOnly) like this:

class Program
static void Main(string[] args)
string serviceName = "FIMService"; //servicename (NOT display Name)

RegistryKey registryKey = Registry.LocalMachine.OpenSubKey(string.Format(@"SYSTEM\CurrentControlSet\Services\{0}", serviceName));

string display = registryKey.GetValue("DisplayName") as string;
string exePath = registryKey.GetValue("ImagePath") as string;
string accountName = registryKey.GetValue("ObjectName") as string;

Console.WriteLine(display ?? "<not found>");
Console.WriteLine(exePath ?? "<not found>");
Console.WriteLine(accountName ?? "<not found>");


No comments: