isvcpwd: Service Account Password Maintenance

isvcpwd is a utility designed to assist with service account password maintenance in Windows environments. It addresses a common security issue: network-aware services often run under dedicated accounts that may have elevated privileges, while their passwords remain unchanged for long periods of time.

The tool helps locate service accounts across a Windows domain and enables administrators to notify affected services or systems when password changes are required. By running isvcpwd from a central location, periodic password maintenance tasks can be performed in a more consistent and manageable way.

isvcpwd also supports filtering of target systems based on host names or IP address ranges, allowing administrators to limit operations to specific machines or network segments.

Examples:

isvcpwd.exe --account SvcDHCP

Lists all services run by the accounts matching SvcDHCP on the local machine (case sensitive).

isvcpwd.exe --account SvcDHCP,SvcDB --password password1,password2 --domain mydomain

Enumerates all servers in the domain mydomain, finds all services run by the account(s) matching SvcDHCP or SvcDB, and notifies them about new passwords password1 and password2 respectively.

isvcpwd.exe --account SvcSQL --domain mydomain --password password1 --filter "name match sqlserv,ip match 10\.10\.10\."

Enumerates all servers in the domain mydomain, selects servers with the names matching sqlserv and the ip-addresses matching 10.10.10, finds all services run by account(s) matching SvcSQL and notifies them about the new password password1.

Project lifetime: Dec 2008