使用PowerShell脚本更改Windows服务

Question

I wrote a PowerShell script to change the login user for a service on my remote VMs. It works when I execute it. However, when I send it to my coworkers, the script appears that it ran without errors and they checked it still listed as "local account'.

$account  = Read-Host "Please admin account Name"
$password = Read-Host -AsSecureString "Please enter your password"
$password = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($password))
$service  = Read-Host "Enter service name"

$computers = Get-Content -Path ".\servers.txt"

foreach ($computer in $computers) {
  $svc = gwmi Win32_Service -ComputerName $computer -Filter "name='$service'"
  $svc.StopService()
  $svc.Change($null,$null,$null,$null,$null,$null,$account,$password,$null,$null,$null)
  $svc.StartService()
}

Write-Host $service "is now running as" $account
Read-Host

Answer 1

I would move this block

foreach ($computer in $computers) {
$svc = gwmi Win32_Service -ComputerName $computer -Filter "name='$service'"
$svc.StopService()     
$svc.Change($null,$null,$null,$null,$null,$null,$account,$password,$null,$null,$null)
$svc.StartService()
}

into a invoke-command block. Cmd-lets using the -Computer parameter implement the remote actions in a proprietary way, while invoke-command uses WSMAN (-> more standardized way).

Try this:

foreach ($computer in $computers) {
   # $computer can be either an IP-address or a FQDN e.g. computer.mydomain
   invoke-command -computer $computer -credential (get-credential) -scripblock {
      $svc = gwmi Win32_Service -ComputerName $computer -Filter "name='$service'"
      $svc.StopService()     
      $svc.Change($null,$null,$null,$null,$null,$null,$account,$password,$null,$null,$null)
      $svc.StartService()
   }
}

With that proposal all actions are performed on the remote machine. In contrary to the first attempt. The first attempt "fetches" the remote objects to you local machine (objects are converted), than you locally perform some actions on the converted object (-> changed properties are send back to the remote).

If your computer is not in the same domain as the remote ones, you've to add your remote targets to your local trusted host list. This link describes how to update your trusted hosts list.

You should also check if Powershell remoting is active on your targets, also described in this link . If your target OS is WIN Server 2012 R2 Powershell remoting is active per default.