37

How to change user credentials of windows service from command line?

Gal Shadeck
  • 532
  • 1
  • 8
  • 13

4 Answers4

76
sc.exe config "Service Name" obj= "DOMAIN\User" password= "password" type= own

See Shortcut Setting Log-On Credentials for Windows Services » jonathanmalek.com.

@MattT points out that on Windows Server 2008R2 you have to add type= own, but prior to that version it isn't necessary.

In PowerShell 3+, you can avoid escaping the arguments with the stop-parsing symbol: --%

sc.exe --% config "Service Name" obj= "DOMAIN\User" password= "password" type= own
Doug Porter
  • 7,721
  • 4
  • 40
  • 55
brianary
  • 8,996
  • 2
  • 35
  • 29
  • 4
    Is there any way to grant the user the "Log on as a Service" right from the command line as well? – ColinM Feb 27 '13 at 22:49
  • Apparently there's a Resource Kit tool for this: http://serverfault.com/questions/188383/looking-to-add-the-log-on-as-a-service-right-to-an-account-via-the-command-lin – brianary Feb 28 '13 at 20:51
  • Using sc to change credentials (of windows service) in remote computer ? – Kiquenet Oct 16 '14 at 21:20
  • 1
    @Kiquenet `sc.exe \\servername config …` (the backslashes are required) http://technet.microsoft.com/en-us/library/cc990290.aspx – brianary Oct 16 '14 at 21:23
  • 1
    Note that special characters in passwords require escaping--in my case a `%` caused a service logon failure until I changed it to `%%`. See http://stackoverflow.com/a/27451200/550712. – Mark Berry Dec 12 '14 at 20:02
  • @MarkBerry Yes, depending on what command line you are using. cmd.exe requires escaping %, in powershell you should quote the strings using single quotes (escaping as appropriate), to minimize the amount of escaping required. Just using a variable for the password in powershell could also simplify the process. – brianary Dec 12 '14 at 20:07
  • I'm using a "DOS" batch (.cmd). Seems that it may be enough to enclose the password in double quotation marks, then double up `%%` and `""` in the password. Didn't actually try typing it at the command line as the OP asked--that might work differently. – Mark Berry Dec 12 '14 at 23:41
  • 4
    as of Windows server 2008R2 it is necessary to add the argument "type= own" (without the quotes) for this to work. Otherwise sc reports the error "The parameter is incorrect" – Matt T Jul 21 '15 at 13:13
  • 1
    After changing logon from this command, I faced issue while starting the service using "net start service_name". This happened because of logon service rights missing from user. https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc794944(v=ws.10) – Vaibhav Jain Jun 06 '19 at 12:10
11

I simply called WMI from powershell to do this.

$Svc = Get-WmiObject win32_service -filter "name='ServiceName'"
$Svc.Change($Null, $Null, $Null, $Null, $Null, $Null, "User", "Password")

Don't forget to restart the service afterwards:

Stop-Service -Name 'ServiceName'
Start-Service -Name 'ServiceName'

For more fun with WMI and services, see Win32_Service Class

Jesse Weigert
  • 4,714
  • 5
  • 28
  • 37
3

Using WMI results in non-encrypted communication between your machine and the machine you are changing the service credentials on. So your new password can be sniffed quite easily. You just have to parse the WMI blob send over the network. By now I found no really secure way to change a service accounts password remotely with a tool.

Markus
  • 31
  • 1
  • Can't you force encrypted communication? Something from this page might help? https://msdn.microsoft.com/en-us/library/aa393266(v=vs.85).aspx – wilx Aug 22 '17 at 13:38
0

For those who are wondering how to pass a secure password:

$credentials = Get-Credential -UserName 'Domain\username' -Message 'Enter password below'
$service = Get-WmiObject win32_service -filter "name='SERVICE_NAME'"
$service.Change($null,$null,$null,$null,$null,$null,$credentials.username,($credentials.Password | ConvertFrom-SecureString))
Gideon Gyabaah
  • 388
  • 2
  • 7