Skip to content

Instantly share code, notes, and snippets.

@joshfinley
Created May 14, 2025 23:44
Show Gist options
  • Save joshfinley/b9ef8ef3f286aee93b55e7d0f5bab518 to your computer and use it in GitHub Desktop.
Save joshfinley/b9ef8ef3f286aee93b55e7d0f5bab518 to your computer and use it in GitHub Desktop.
autogenerated list of possible microsoft related service accounts
devops-sys
scdpmsys
sys-outlook
kerberos_svc
sys_teams
scdpm_sys
dfssys
vssagentsys
exedge-svc
systeams
svc_dns
sccm-svc
sysyammer
powerautomate_svc
msol-sys
fsmo_svc
sysfslogix
svc-dynamics365
sysdev.azure
svc_mssql
svc-scvmm
cortana-svc
svc-kerberos
dynamics365_sys
sys-sharepoint
onenote-svc
o365svc
svc_aadconnect
sys-word
sys_iisweb
sysrdp
sys-fsmo
devopssys
scsm_sys
sys-vmm
svc_vm
sys_ts
adfs-sys
azure-sys
svcsqlsvc
sysazdev
microsoft365svc
svc_ntp
svc-msol
msmtpsys
svcadrms
microsoftdynamicssys
ntp-svc
sys-wsus
rdwebsys
kdcsvc
dfssvc
svcpowerautomate
wins-svc
adcssys
syssql
sys-msol
dfsr-sys
vssagent-svc
svc_sqlexpress
sysintune
svcoutlook
aadconnect_sys
scvmm_sys
gmsasys
svc_microsoft365
sys_dev.azure
teams_svc
svc-powerapps
svc_adfs
dev.azuresvc
sccm_sys
svcdevops
rdweb_sys
powerautomate-sys
vmhostsys
devops_svc
svc_adcs
svcvmhost
logon-svc
msmtp_svc
svc-rdweb
powerautomate_sys
sys-sqlexpress
vm_svc
adfs_sys
iisappsvc
sqlsvc-svc
onenote-sys
logon_svc
domain-svc
svc_kerberos
sysmssql
sqlsvc_sys
sys-aad
svc-iisweb
dfsrsvc
svc-microsoftdynamics
sysadfs
sys_kerberos
outlook-svc
bing-svc
dev.azure-sys
logonsvc
exchange-svc
svcgmsa
svc_dfs
loop_svc
adrmssvc
krb-sys
sysexmbx
svc_onenote
sqlsys
streamsvc
sys_scvmm
streamsys
dynamics365-sys
whiteboard-sys
svcplanner
svc_krb
svc_word
svc-exmbx
svcdns
svc-dfs
fslogix_sys
svcexchange
sql_sys
sys-adfs
o365-sys
sys-defender
windowshello_svc
fslogix-sys
loginsys
loop-svc
scom_sys
msmtp_sys
sys-onedrive
scomsys
dhcp-svc
azagent-svc
svc-dfsr
exedgesvc
svckerberos
rdp_svc
svcscdpm
svc-whiteboard
memcm-sys
syssccm
exchangesys
planner_sys
microsoft365-svc
sysword
sys-devops
svcsqlexpress
windowshellosys
sys_sql
sys-fslogix
cortana_svc
planner-svc
microsoft365_sys
sccmsys
sys_outlook
sharepointsys
adfs_svc
domainsvc
bing_svc
svckrb
winssys
sys-scvmm
svc-dns
azdev_svc
wordsys
svc_sccm
azdevsys
svc-vssagent
vssagent_svc
svc-onedrive
fsmosys
svc_msol
sysvssagent
svc-azagent
sys-domain
outlooksvc
o365_sys
sys_ldap
sys_sharepoint
sys-login
vsssvc
svcmsolsvc
sqlsvcsys
svcintune
outlook_svc
exch-sys
iisapp_svc
sysmicrosoftdynamics
svc-aad
svcsql
sys-aadconnect
sys_aad
sys_bing
azuredevops-sys
msolsvc_svc
windowshellosvc
vmsys
aadconnect-sys
cortanasvc
svc_yammer
iis-svc
svc-krb
svc-intune
svcvm
svc-mssql
sys_stream
krbsys
sys_msolsvc
syspowerbi
cortana_sys
scsmsys
sys_vss
exchsys
mssql_svc
sysdefender
yammer-svc
exch_svc
msol_sys
iisapp_sys
dynamics365svc
sys_whiteboard
svc-adfs
dynamics365sys
sys-gmsa
kdc_svc
dfs-svc
sysdevops
sys_exch
bingsvc
svcvss
svc_vmm
scdpm-svc
kerberos_sys
sysscsm
dfsrsys
bing-sys
svc-ts
scom-svc
sys-azuredevops
dnssys
azure_sys
svc-gmsa
cortana-sys
gmsa-sys
powerbi-svc
sys_defender
sys-logon
svc-adrms
sys-exmbx
dev.azuresys
sys_word
svc_sqlsvc
exedge_sys
kdcsys
ts-svc
sharepoint_sys
exchange-sys
svc_msmtp
sysexchange
ldapsvc
sysexch
sys-cortana
gmsa_svc
vss_svc
svc_devops
sharepointsvc
sys-scsm
svc-onenote
sysscvmm
svc-word
sys_vmm
winssvc
svc_adsync
stream_sys
svcadcs
scdpmsvc
scomsvc
graph-svc
exmbx_svc
defender-svc
outlook_sys
svconenote
powerappssvc
sys-kerberos
adsync-svc
svc_wsus
vss-svc
svc_dev.azure
domain_sys
vmmsvc
dynamics365-svc
sys-ldap
sys_gmsa
gmsa_sys
sys-powerbi
sys-vmhost
iissys
mssql-sys
svc-fsmo
svcmssql
sys_vssagent
svcmsmtp
sys_microsoftdynamics
fsmo-sys
dns_sys
svcdhcp
powerapps_sys
svc_wins
sys-scom
sys_login
sys-scdpm
syswsus
sys-azure
sys_adfs
powerapps_svc
exedgesys
svc_whiteboard
ntpsvc
sys-dfsr
plannersys
svcsharepoint
svcyammer
fslogixsvc
sys_o365
svc_dynamics365
powerapps-svc
onenote_svc
krb-svc
vmhostsvc
sys_onenote
sys_intune
aadsys
onenotesys
onedrivesys
sysmicrosoft365
svc_dhcp
iisapp-svc
domain_svc
exmbx-svc
windowshello_sys
login_svc
fslogix_svc
svccortana
iisapp-sys
svcwins
scdpm_svc
adcs-svc
sysvmm
azdev-svc
syslogon
onenotesvc
sysazure
scvmmsys
svc_scsm
svcloop
svc_defender
scdpm-sys
whiteboard-svc
svcvssagent
svc-powerbi
azdev_sys
yammersvc
wsus-svc
logon-sys
syskdc
azure_svc
svc-iis
powerbi_svc
msolsvc-sys
svcaad
mssql-svc
scsm_svc
syspowerautomate
yammer_svc
powerbi-sys
rdweb_svc
sys-vssagent
svcmsol
teams-sys
sys-azagent
azagent-sys
sys-dhcp
scom_svc
svcpowerbi
svc-sql
svc_rdweb
exchangesvc
sharepoint-svc
whiteboard_svc
sys_devops
sys-rdweb
adsyncsys
iis_svc
syskerberos
whiteboard_sys
wins-sys
sys-onenote
adcs_svc
whiteboardsys
sqlsvcsvc
svc-domain
sys-memcm
sys_dfsr
syscortana
sysiisweb
dfsr_sys
svcmicrosoftdynamics
svcadsync
sys-adrms
msolsys
sysdfs
sharepoint-sys
svclogin
azuresys
krb_sys
svcexedge
svc-exch
sys_powerautomate
wsus_sys
sqlsvc
intune_sys
svcwsus
svc_aad
svcdynamics365
svclogon
sysmsmtp
svc_rdp
aadconnectsys
svc_exedge
sys_msmtp
svc-planner
ldap-sys
exch_sys
svc-vmhost
svcfslogix
sys-kdc
loopsvc
azure-svc
svconedrive
iisweb_svc
plannersvc
svcazdev
sys_azure
sysvm
exedge-sys
msol_svc
svc_ts
svc_memcm
svc-vmm
sys_exedge
syssqlsvc
graphsys
syssharepoint
svc_iisapp
svcrdp
svc-windowshello
svc-vm
stream-sys
sys_aadconnect
iiswebsys
azagentsvc
outlooksys
iisweb-sys
svc-scdpm
sys-rdp
powerbi_sys
sys_dns
aadsvc
sysntp
sqlexpress_sys
svc-microsoft365
msmtp-sys
sqlexpress-sys
krb_svc
dynamics365_svc
sys_kdc
svcwindowshello
svcmemcm
ntpsys
vm-svc
adcs-sys
sysadsync
sys_dhcp
sys_wins
svc-logon
svc-dev.azure
sysvmhost
svcazure
syswins
sys-exedge
sys_memcm
svckdc
svc_graph
svc_scom
svc_azdev
sys_onedrive
exmbx_sys
sys_iisapp
powerbisvc
yammersys
svc-iisapp
svc_azuredevops
sysgraph
dhcp-sys
sys-bing
svc_azagent
sys_fslogix
scvmm-svc
sysvss
svc-loop
sys-msmtp
microsoft365-sys
mssqlsys
sys_adsync
sys_iis
aad-svc
rdweb-sys
sysdhcp
logon_sys
exchange_sys
vmhost_svc
msmtp-svc
svc-login
svc_scvmm
sqlexpress_svc
dns_svc
sys-dev.azure
svco365
svc-stream
sys_adrms
svciisweb
dns-sys
microsoft365sys
svcstream
svc-adcs
powerbisys
ldapsys
dfs_svc
aadconnectsvc
devopssvc
sys_scsm
vmhost-svc
vmm_sys
svc_bing
sysoutlook
sys_krb
sql-svc
domainsys
svc_login
defendersys
svc_exch
svc-dhcp
sys_msol
aad-sys
svc_cortana
sys_graph
aadconnect-svc
kerberossvc
svc-ntp
adfssys
iis_sys
sys-vss
memcm_sys
word-sys
svcldap
rdweb-svc
azdevsvc
svc_microsoftdynamics
dfs_sys
memcm_svc
vssagent-sys
sys_loop
azuredevops_sys
gmsasvc
sysazuredevops
sysscdpm
adsync_svc
svc_sharepoint
sys-exch
powerautomatesys
domain-sys
svc_kdc
onedrivesvc
powerautomatesvc
scsm-sys
svc-msolsvc
ts_svc
sys-powerautomate
exmbxsvc
sysdynamics365
ntp_svc
msolsvc-svc
svc_msolsvc
svc-azuredevops
sysdfsr
sysmsolsvc
svcgraph
kerberossys
onedrive_sys
sqlsvc-sys
dfsr-svc
vm-sys
svc_sql
iisweb-svc
msolsvcsys
svc-exedge
azuredevops-svc
systs
msol-svc
defendersvc
svcdfs
sysgmsa
iiswebsvc
sys-ntp
aad_sys
svcadfs
sys-planner
intune_svc
exmbx-sys
svcexmbx
adrms-sys
sys_ntp
sys-iisapp
tssys
sys_domain
kdc-sys
svc-exchange
teamssys
powerapps-sys
wins_sys
stream-svc
svcsccm
msolsvcsvc
o365sys
svc-teams
svc-wsus
sysiisapp
sys_windowshello
intunesys
svc_powerbi
wsus_svc
adsync_sys
memcmsvc
svc-devops
sys_cortana
svcts
powerautomate-svc
teams-svc
svc_loop
sys_sccm
sys_mssql
svciisapp
stream_svc
login-sys
svc-sharepoint
sys-yammer
azdev-sys
defender_svc
sys-windowshello
svcteams
dfsr_svc
dhcp_sys
svcword
intune-svc
graph_sys
svc_outlook
svcazagent
sccm_svc
yammer-sys
vmm_svc
intune-sys
graphsvc
svcdomain
exch-svc
sys_dynamics365
tssvc
svcazuredevops
vsssys
sys-iisweb
word_sys
svcdefender
onedrive_svc
kerberos-svc
sys-sccm
svcdev.azure
sys-wins
svc-o365
sys-stream
graph-sys
sys_scdpm
adrmssys
sys-azdev
syswhiteboard
loopsys
sysfsmo
svc_vmhost
svc-scom
ldap_svc
adcs_sys
sysdns
sysdomain
svc_ldap
loginsvc
adsync-sys
microsoftdynamics_svc
sys-sql
o365-svc
vss_sys
ldap-svc
sysscom
svcwhiteboard
svc_intune
logonsys
sys_azuredevops
sysmsol
msmtpsvc
whiteboardsvc
svc_powerapps
svcfsmo
svc_planner
azuresvc
svc-wins
sys-mssql
vmhost_sys
sys-o365
svc-defender
svc-vss
wsussys
vssagent_sys
svc_powerautomate
exchsvc
cortanasys
fsmo-svc
svc_vssagent
svcrdweb
vmsvc
word_svc
mssql_sys
azuredevopssys
login_sys
aadconnect_svc
svc_teams
sys_wsus
svc_o365
svciis
rdpsvc
sysbing
dns-svc
memcmsys
svcexch
fsmosvc
dev.azure-svc
svcaadconnect
wsussvc
wins_svc
sysloop
svc-azure
ts_sys
sys-teams
vss-sys
svcscvmm
sysaadconnect
wordsvc
loop-sys
powerappssys
bing_sys
sys_vm
dhcpsys
svc_windowshello
rdpsys
svc-cortana
sql-sys
devops-svc
svc_fslogix
svcscom
syso365
sys-exchange
defender-sys
krbsvc
svc-ldap
svc-powerautomate
adrms_svc
sys-microsoftdynamics
sys_rdweb
ntp-sys
svcdfsr
microsoftdynamics_sys
svc-aadconnect
sys_powerapps
sys-graph
svc-bing
microsoftdynamics-svc
sys-powerapps
syssqlexpress
dnssvc
svc_adrms
sys_logon
sqlexpress-svc
memcm-svc
sqlsvc_svc
adrms-svc
sys_sqlexpress
exmbxsys
sys_exchange
svc-adsync
svc_azure
mssqlsvc
scsmsvc
vmm-sys
kdc_sys
svc_domain
svc_stream
sys_azagent
defender_sys
msolsvc_sys
svc_iis
sys_planner
sys-iis
exchange_svc
azuredevopssvc
sysplanner
windowshello-sys
scvmm-sys
sccmsvc
teamssvc
sys-loop
outlook-sys
gmsa-svc
sys_sqlsvc
svcntp
sys-adcs
azuredevops_svc
sysonenote
microsoftdynamicssvc
svc-memcm
adsyncsvc
aad_svc
rdp_sys
vmm-svc
svc_gmsa
iisappsys
iisweb_sys
onenote_sys
sysiis
syspowerapps
yammer_sys
sys-microsoft365
sharepoint_svc
fslogix-svc
teams_sys
sysldap
loop_sys
svc-sccm
scsm-svc
planner_svc
svc_onedrive
dev.azure_svc
svc-msmtp
sys_yammer
ts-sys
svcbing
sys-msolsvc
svc_vss
svc-sqlexpress
scvmm_svc
sysonedrive
scvmmsvc
iissvc
sysazagent
svc-azdev
svc_fsmo
svc-outlook
svc-graph
onedrive-svc
svc-sqlsvc
sysmemcm
ldap_sys
o365_svc
adfs-svc
azagent_svc
sys_dfs
svc_iisweb
sys-sqlsvc
sys_vmhost
intunesvc
ntp_sys
syslogin
vssagentsvc
svc-yammer
windowshello-svc
sys-dynamics365
adrms_sys
svcscsm
sys-adsync
bingsys
syswindowshello
adfssvc
sys-whiteboard
devops_sys
graph_svc
sys_rdp
sys_powerbi
sys-vm
sys_scom
sysexedge
sys_exmbx
svc-kdc
sys-ts
svcpowerapps
rdp-svc
sysstream
onedrive-sys
kdc-svc
sys-dfs
sys_fsmo
rdp-sys
svc-fslogix
svc-rdp
sys_microsoft365
kerberos-sys
sys-dns
dfs-sys
sys-intune
planner-sys
microsoftdynamics-sys
svc_logon
dev.azure_sys
msolsvc
iis-sys
wsus-sys
vm_sys
azagentsys
microsoft365_svc
sys_adcs
sysrdweb
sysaad
word-svc
rdwebsvc
sys-krb
scom-sys
sysadrms
sys_azdev
sysadcs
svc_exchange
vmmsys
sqlexpresssvc
dhcp_svc
fsmo_sys
azagent_sys
fslogixsys
vmhost-sys
svc_exmbx
svc-scsm
sql_svc
svcvmm
sccm-sys
dhcpsvc
exedge_svc
syskrb
svc_scdpm
login-svc
svcmicrosoft365
adcssvc
sqlexpresssys
svc_dfsr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment