{"id":42214,"date":"2025-06-20T20:06:21","date_gmt":"2025-06-20T11:06:21","guid":{"rendered":"https:\/\/jouhou.main.jp\/?p=42214"},"modified":"2026-02-06T17:26:05","modified_gmt":"2026-02-06T08:26:05","slug":"windows-error_invalid_service_account-1077-%e5%af%be%e7%ad%96%ef%bc%9a%e7%84%a1%e5%8a%b9%e3%81%aa%e3%82%b5%e3%83%bc%e3%83%93%e3%82%b9%e3%82%a2%e3%82%ab%e3%82%a6%e3%83%b3%e3%83%88%e3%82%a8%e3%83%a9","status":"publish","type":"post","link":"https:\/\/jouhou.main.jp\/?p=42214","title":{"rendered":"Windows ERROR_INVALID_SERVICE_ACCOUNT (1077) \u5bfe\u7b56\uff1a\u7121\u52b9\u306a\u30b5\u30fc\u30d3\u30b9\u30a2\u30ab\u30a6\u30f3\u30c8\u30a8\u30e9\u30fc\u306e\u89e3\u6d88\u3068\u5fa9\u65e7\u7de8"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\r\n\r\n
\u6700\u77ed\u30c1\u30a7\u30c3\u30af<\/div>
\u300c\u7121\u52b9\u306a\u30b5\u30fc\u30d3\u30b9\u30a2\u30ab\u30a6\u30f3\u30c8\u300d\u7cfb\u306e\u8d77\u52d5\u5931\u6557\u3092\u3001\u6700\u5c0f\u5909\u66f4\u3067\u5207\u308a\u5206\u3051\u308b<\/div>
1077\u304c\u898b\u3048\u3066\u3082\u201c\u539f\u56e0\u305d\u306e\u3082\u306e\u201d\u3068\u306f\u9650\u308a\u307e\u305b\u3093\u3002\u307e\u305a\u4e8b\u5b9f\uff08\u30ed\u30b0\u30fb\u8a2d\u5b9a\u30fb\u6a29\u9650\uff09\u3092\u63c3\u3048\u308b\u3068\u3001\u5fa9\u65e7\u304c\u77ed\u8ddd\u96e2\u3067\u53ce\u675f\u3057\u3084\u3059\u304f\u306a\u308a\u307e\u3059\u3002<\/div> <\/div>
1<\/span>
30\u79d2\u3067\u4e89\u70b9\u3092\u7d5e\u308b<\/div>
\u300c\u4f55\u304c\u5909\u308f\u3063\u305f\u304b\u300d\u3092\u5148\u306b\u7279\u5b9a\u3057\u307e\u3059\uff08\u30a2\u30ab\u30a6\u30f3\u30c8\u72b6\u614b\uff0f\u8cc7\u683c\u60c5\u5831\uff0f\u6a29\u9650\uff0f\u540c\u5c45\u30b5\u30fc\u30d3\u30b9\uff09\u3002\u4f5c\u696d\u306f\u201c\u78ba\u8a8d\u4e2d\u5fc3\u201d\u3067\u3001\u5909\u66f4\u306f\u6700\u5f8c\u306b\u6700\u5c0f\u9650\u3002<\/div> 
# \u76f4\u8fd1\u306e\u4e8b\u5b9f\u3092\u63c3\u3048\u308b\uff08\u30b5\u30fc\u30d3\u30b9\u540d\u306f\u7f6e\u304d\u63db\u3048\uff09 sc.exe query \"\u30b5\u30fc\u30d3\u30b9\u540d\" sc.exe qc \"\u30b5\u30fc\u30d3\u30b9\u540d\"\r\n\u5931\u6557\u30e1\u30c3\u30bb\u30fc\u30b8\u3092\u77ed\u304f\u62fe\u3046\uff08System\u30ed\u30b0\uff1a7000\/7009\/7011\/7041\u306a\u3069\uff09\r\npowershell -NoProfile -Command \"Get-WinEvent -FilterHashtable @{LogName='System'; Id=7000,7009,7011,7041} -MaxEvents 30 | Select TimeCreated,Id,Message | Format-List\"\r\n\r\n\u8ab0\u3068\u3057\u3066\u8d77\u52d5\u3059\u308b\u8a2d\u8a08\u304b\uff08SERVICE_START_NAME \u3092\u78ba\u8a8d\uff09\r\n\u2192 LocalSystem \/ LocalService \/ NetworkService \/ .\\\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc \/ \u30c9\u30e1\u30a4\u30f3\\\u30e6\u30fc\u30b6\u30fc \/ gMSA(\u672b\u5c3e$) \u306a\u3069<\/pre>\r\n  <\/div>\r\n<\/div>\r\n<\/div> 
 
 2<\/span> 
 
\u4e89\u70b9\u5225\uff1a\u4eca\u5f8c\u306e\u9078\u629e\u3084\u884c\u52d5<\/div> 
\u201c\u3069\u306e\u4e89\u70b9\u304b\u201d\u3067\u6253\u3061\u624b\u304c\u5909\u308f\u308a\u307e\u3059\u3002\u307e\u305a\u5f53\u3066\u306b\u3044\u304f\u305f\u3081\u306e\u6700\u77ed\u30eb\u30fc\u30c8\u3092\u3001\u30b1\u30fc\u30b9\u5225\u306b\u5206\u3051\u3066\u304a\u304d\u307e\u3059\u3002<\/div>\r\n    
\r\n      
\u30b1\u30fc\u30b9A\uff1a\u30d1\u30b9\u30ef\u30fc\u30c9\u5909\u66f4\u30fb\u671f\u9650\u5207\u308c\u30fb\u30ed\u30c3\u30af\u30a2\u30a6\u30c8\u304c\u7591\u308f\u3057\u3044<\/div>\r\n      
# \u9078\u629e\u3068\u884c\u52d5\uff08\u78ba\u8a8d\u2192\u6700\u5c0f\u5909\u66f4\uff09\r\n1) \u30b5\u30fc\u30d3\u30b9\u304c\u4f7f\u3046\u30a2\u30ab\u30a6\u30f3\u30c8\u3092\u7279\u5b9a\uff08StartName\uff09\r\nsc.exe qc \"\u30b5\u30fc\u30d3\u30b9\u540d\"\r\n\r\n2) \u5931\u6557\u7406\u7531\u3092\u30ed\u30b0\u3067\u7279\u5b9a\uff08\u30e1\u30c3\u30bb\u30fc\u30b8\u672c\u6587\u304c\u6700\u77ed\u30d2\u30f3\u30c8\uff09\r\npowershell -NoProfile -Command \"Get-WinEvent -FilterHashtable @{LogName='System'; Id=7000,7041} -MaxEvents 20 | Select TimeCreated,Message | Format-List\"\r\n\r\n3) \u30c9\u30e1\u30a4\u30f3\u904b\u7528\u306a\u3089\uff1a\u30ed\u30c3\u30af\/\u7121\u52b9\/\u671f\u9650\/\u30d1\u30b9\u30ef\u30fc\u30c9\u5909\u66f4\u306e\u6709\u7121\u3092\u78ba\u8a8d\uff08\u6a29\u9650\u7bc4\u56f2\u3067\uff09\r\n\u4f8b\uff09net user \u30e6\u30fc\u30b6\u30fc\u540d \/domain\r\n\u4f8b\uff09AD\u7ba1\u7406\u30c4\u30fc\u30eb\u304c\u3042\u308b\u306a\u3089 Get-ADUser \u3067 Enabled\/LockedOut\/PasswordExpired \u306a\u3069\r\n4) \u4fee\u6b63\u304c\u5fc5\u8981\u306a\u3089\uff1a\u540c\u4e00\u30a2\u30ab\u30a6\u30f3\u30c8\u3092\u4f7f\u3044\u7d9a\u3051\u308b\u524d\u63d0\u3067\u3001\u8cc7\u683c\u60c5\u5831\u306e\u6574\u5408\u3060\u3051\u6700\u5c0f\u3067\u623b\u3059\uff08\u5e83\u3044\u8a2d\u5b9a\u5909\u66f4\u306f\u5f8c\u56de\u3057\uff09<\/pre>\r\n    <\/div>\r\n\r\n    
\r\n      
\u30b1\u30fc\u30b9B\uff1a\u300cLog on as a service\u300d\u6a29\u9650\u4e0d\u8db3\uff0fGPO\u3067\u306e\u4e0a\u66f8\u304d\u304c\u7591\u308f\u3057\u3044<\/div>\r\n      
# \u9078\u629e\u3068\u884c\u52d5\uff08\u201c\u6a29\u9650\u201d\u3092\u7591\u3046\u6642\u306e\u6700\u77ed\uff09\r\n1) \u76f4\u8fd1\u306e\u30dd\u30ea\u30b7\u30fc\u9069\u7528\u72b6\u6cc1\uff08GPO\u304c\u52b9\u3044\u3066\u3044\u308b\u304b\uff09\r\ngpresult \/r\r\n\r\n2) \u30ed\u30fc\u30ab\u30eb\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30dd\u30ea\u30b7\u30fc\u306e\u8f38\u51fa\u3067\u5dee\u5206\u3092\u53d6\u308a\u3084\u3059\u304f\u3059\u308b\r\nsecedit \/export \/cfg \"%TEMP%\\secpol_export.cfg\"\r\n\r\n3) \u76e3\u67fb\u30ed\u30b0\uff08Security\uff09\u306b\u30ed\u30b0\u30aa\u30f3\u62d2\u5426\u304c\u6b8b\u308b\u74b0\u5883\u306a\u3089\u3001\u8a72\u5f53\u6642\u523b\u306e\u30a4\u30d9\u30f3\u30c8\u3092\u78ba\u8a8d\r\npowershell -NoProfile -Command \"Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 30 | Select TimeCreated,Message | Format-List\"\r\n\r\n4) \u5bfe\u5fdc\u306f\u201c\u5fc5\u8981\u306a\u6a29\u9650\u3060\u3051\u201d\u306b\u9650\u5b9a\u3057\u3001\u5bfe\u8c61\u30a2\u30ab\u30a6\u30f3\u30c8\u3068\u5bfe\u8c61\u30db\u30b9\u30c8\u306e\u7bc4\u56f2\u3092\u5e83\u3052\u306a\u3044\u65b9\u91dd\u3067\u53ce\u675f\u3055\u305b\u308b<\/pre>\r\n    <\/div>\r\n\r\n    
\r\n      
\u30b1\u30fc\u30b9C\uff1agMSA\/Managed Service Account \u306e\u8a2d\u5b9a\u5d29\u308c\u304c\u7591\u308f\u3057\u3044\uff08\u672b\u5c3e$\u306a\u3069\uff09<\/div>\r\n      
# \u9078\u629e\u3068\u884c\u52d5\uff08gMSA\u306f\u201c\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u4eba\u304c\u6301\u305f\u306a\u3044\u201d\u524d\u63d0\uff09\r\n1) \u30b5\u30fc\u30d3\u30b9\u304c gMSA \u3092\u4f7f\u3063\u3066\u3044\u308b\u304b\uff08StartName\u306b\u672b\u5c3e$\u306a\u3069\uff09\r\nsc.exe qc \"\u30b5\u30fc\u30d3\u30b9\u540d\"\r\n\r\n2) \u5909\u66f4\u5c65\u6b74\uff08\u3044\u3064\u304b\u3089\u5931\u6557\u3057\u305f\u304b\uff09\u3092 System\u30ed\u30b0\u3067\u8ffd\u3046\r\npowershell -NoProfile -Command \"Get-WinEvent -FilterHashtable @{LogName='System'; Id=7000,7041} -MaxEvents 30 | Select TimeCreated,Message | Format-List\"\r\n\r\n3) \u5bfe\u5fdc\u306f AD\u5074\u306e\u8a31\u53ef\uff08\u305d\u306e\u30db\u30b9\u30c8\u304cgMSA\u3092\u5229\u7528\u3067\u304d\u308b\u304b\uff09\u3068\u3001\u30b5\u30fc\u30d3\u30b9\u8a2d\u5b9a\u306e\u4e00\u81f4\u3092\u201c\u6700\u5c0f\u5909\u66f4\u3067\u201d\u63c3\u3048\u308b\u65b9\u91dd\r\n\u4f8b\uff1a\u30db\u30b9\u30c8\u5074\u306e\u6a29\u9650\u30fbSPN\u30fb\u59d4\u4efb\u306a\u3069\u3001\u74b0\u5883\u4f9d\u5b58\u70b9\u306f\u5909\u66f4\u524d\u306b\u5f71\u97ff\u7bc4\u56f2\u3092\u56fa\u5b9a\u3059\u308b<\/pre>\r\n    <\/div>\r\n\r\n    
\r\n      
\u30b1\u30fc\u30b9D\uff1a\u540c\u5c45\u30b5\u30fc\u30d3\u30b9\u3068\u306e\u4e0d\u6574\u5408\uff08\u5225\u30b5\u30fc\u30d3\u30b9\u3068\u540c\u4e00\u30d7\u30ed\u30bb\u30b9\u3067\u52d5\u304f\u6642\uff09<\/div>\r\n      
# \u9078\u629e\u3068\u884c\u52d5\uff08\u540c\u4e00\u30d7\u30ed\u30bb\u30b9\u306b\u201c\u5225\u306e\u30a2\u30ab\u30a6\u30f3\u30c8\u201d\u3092\u6df7\u5728\u3055\u305b\u306a\u3044\uff09\r\n1) \u5bfe\u8c61\u30b5\u30fc\u30d3\u30b9\u306e\u69cb\u6210\u78ba\u8a8d\uff08\u5171\u6709\u30d7\u30ed\u30bb\u30b9\u3084\u4f9d\u5b58\u95a2\u4fc2\u306e\u6c17\u914d\uff09\r\nsc.exe qc \"\u30b5\u30fc\u30d3\u30b9\u540d\"\r\n\r\n2) \u8fd1\u3044\u30bf\u30a4\u30df\u30f3\u30b0\u3067\u5931\u6557\u3057\u3066\u3044\u308b\u201c\u5225\u306e\u30b5\u30fc\u30d3\u30b9\u201d\u304c\u306a\u3044\u304b\r\npowershell -NoProfile -Command \"Get-WinEvent -FilterHashtable @{LogName='System'; Id=7000,7041} -MaxEvents 60 | Select TimeCreated,Message | Format-Table -Wrap\"\r\n\r\n3) \u5bfe\u5fdc\u306f\u300c\u540c\u5c45\u3057\u3066\u3044\u308b\u30b5\u30fc\u30d3\u30b9\u7fa4\u300d\u3068\u300c\u8d77\u52d5\u30a2\u30ab\u30a6\u30f3\u30c8\u300d\u306e\u6574\u5408\u3092\u53d6\u308a\u3001\u7bc4\u56f2\u5916\u3078\u6ce2\u53ca\u3055\u305b\u306a\u3044\u8a2d\u8a08\u3067\u53ce\u675f\u3055\u305b\u308b<\/pre>\r\n    <\/div>\r\n\r\n  <\/div>\r\n<\/div>\r\n<\/div> 
 
 3<\/span> 
 
\u5f71\u97ff\u7bc4\u56f2\u30921\u5206\u3067\u78ba\u8a8d<\/div> 
\u201c\u76f4\u3057\u3066\u3088\u3044\u7bc4\u56f2\u201d\u3092\u5148\u306b\u78ba\u5b9a\u3057\u307e\u3059\u3002\u4f9d\u5b58\u95a2\u4fc2\u3068\u5b9f\u884c\u6a29\u9650\u306e\u5883\u754c\u304c\u5206\u304b\u308b\u3068\u3001\u6700\u5c0f\u5909\u66f4\u3067\u623b\u3057\u3084\u3059\u304f\u306a\u308a\u307e\u3059\u3002<\/div> 
# \u4f9d\u5b58\u95a2\u4fc2\uff08\u3053\u306e\u30b5\u30fc\u30d3\u30b9\u304c\u6b62\u307e\u308b\u3068\u4f55\u304c\u6b62\u307e\u308b\u304b\uff09 sc.exe qc \"\u30b5\u30fc\u30d3\u30b9\u540d\"\r\n\u72b6\u614b\u3068\u8d77\u52d5\u7a2e\u5225\uff08\u8d77\u52d5\u9045\u5ef6\u3084\u81ea\u52d5\/\u624b\u52d5\u3067\u518d\u73fe\u6761\u4ef6\u304c\u5909\u308f\u308b\uff09\r\nsc.exe query \"\u30b5\u30fc\u30d3\u30b9\u540d\"\r\npowershell -NoProfile -Command \"Get-Service -Name '\u30b5\u30fc\u30d3\u30b9\u540d' | Format-List *\"\r\n\r\n\u76f4\u8fd1\u306e\u5909\u66f4\u70b9\u306e\u624b\u639b\u304b\u308a\uff08\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\/\u66f4\u65b0\/\u518d\u8d77\u52d5\u524d\u5f8c\uff09\r\nsysteminfo | findstr \/i \"Boot Time\"\r\nwmic qfe get HotFixID,InstalledOn | sort\r\n\r\n\u8a8d\u8a3c\u306e\u5916\u5074\u8981\u56e0\uff08\u30c9\u30e1\u30a4\u30f3\u5230\u9054\u6027\u30fb\u6642\u523b\u305a\u308c\uff09\u3092\u7591\u3046\u6642\u306e\u78ba\u8a8d\u6750\u6599\r\nw32tm \/query \/status\r\nnltest \/dsgetdc:\u30c9\u30e1\u30a4\u30f3\u540d<\/pre>\r\n<\/div>\r\n<\/div>\r\n\r\n<\/div> 
 
\u5931\u6557\u3059\u308b\u3068\u3069\u3046\u306a\u308b\uff1f\uff08\u3084\u308a\u304c\u3061\u306a\u30df\u30b9\u3068\u8d77\u3053\u308a\u5f97\u308b\u7d50\u679c\uff09<\/div>