How to find the type of a LogOn account in Win32 Services?

Question

In the Services.exe, For each service, we can see two types of LogOn

1. Local System account
2. This account.

I am just wondering is there any way to classify the LogOn accounts in "This account" to a particular set of enum or groups.

For eg:

1. ./SomeUsername as Local User Account,
2. NT Authority/LocalService as localService
3. NT Authority/NetworkService as Network Service and so on.

Please give me some insights on this!

Answer 1

You can look into services registry branch
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<your sevice name>.

The value ObjectName is what you are looking for.

It will be text string like

• NT AUTHORITY\NetworkService
• NT AUTHORITY\LocalService
• LocalSystem

in case of build-in credentials.