Sysinternals Homepage
Forum Home Forum Home > Sysinternals Utilities > PsTools
  New Posts New Posts RSS Feed - PSEXEC access denied
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

PSEXEC access denied

 Post Reply Post Reply
Author
Message
boldt View Drop Down
Newbie
Newbie


Joined: 16 January 2007
Status: Offline
Points: 3
Post Options Post Options   Thanks (0) Thanks(0)   Quote boldt Quote  Post ReplyReply Direct Link To This Post Topic: PSEXEC access denied
    Posted: 04 December 2008 at 7:49pm
I have spent all morning researching this topic, and while there have been many similar posts, none of them seem to have answered or solved my issue. So here it goes.

We run Numara TrackIT and need to manually run an audit exe on many remote computers. While we have this in the login script there are many 'stragglers' that we wish to audit using psexec from the comfort of our seats.
The audit32.exe needs to run on a local subnet share as it will drop the resulting xml file into a data folder of the same share it was run from (this keeps all the xml files for an office in one spot - as opposed to running the audit locally on each workstation and copying the xml file back up to a central share). If you are still with me then here is the issue with psexec

So from the comfort of my computer I wan to execute the psexec command:

psexec \\computer -u Domain\administrator \\serverXX\Track-it\audit32.exe -i

however I get "access is denied" when executing this.

My understanding is that psexec using the local system account when running on the remote computer, and the local system account does not have network access.

My question is, is there a way around this. In some of my research it 'appears' that version 1.94 should allow for this to work, but for the life of me I can not get it to.

TIA for any advice or suggestions that you might have.

I am thinking about writing a batch file that copies the files from the share to the locally on the remote workstation and then back up, but this just not seem like it should have to be done this way???


Update:
I wanted to mention that by adding removing permissions on this network share (adding the everyone group) that I was able to get the above psexec script to work. This appears to confirm the local system account is being used to access the network using psexec.
Is this a limitation of psexec?


Edited by boldt - 05 December 2008 at 4:45pm
Back to Top
SvenBomwollen View Drop Down
Senior Member
Senior Member


Joined: 29 August 2008
Location: Germany
Status: Offline
Points: 1630
Post Options Post Options   Thanks (0) Thanks(0)   Quote SvenBomwollen Quote  Post ReplyReply Direct Link To This Post Posted: 04 December 2008 at 10:18pm
Hello, boldt.

does your report not read like a clone of this report by aparkerSIA: PSExec - Run application from a local folder share ?!

In both cases it is audit32.exe which works fine if run locally, but fails if run remotely inside a psexec session. ... wait ....

aparkerSIA seems to have found a way of making psexec.exe and audit32.exe co-operate, even though he may not like the price which it costs. cf. here, please.

Regards,
Sven
--
P.S.:
Quote My understanding is that psexec using the local system account when running on the remote computer, and the local system account does not have network access.
Only partially correct. psexec launches a temporary service, psexesvc, on \\computer under the System account. This service in turn will launch audit32.exe under the account which you specified on the psexec commandline.


Back to Top
boldt View Drop Down
Newbie
Newbie


Joined: 16 January 2007
Status: Offline
Points: 3
Post Options Post Options   Thanks (0) Thanks(0)   Quote boldt Quote  Post ReplyReply Direct Link To This Post Posted: 05 December 2008 at 4:58pm
Yes, in fact it does appear to be similar. Thanks.

The issues is, as you point out (and I thought was the case) psexec should launch the exe under the account specified using the -u switch.

However what we are finding is this is not the case. Even sepcifying the domain admin on the -u line psexec is not inheriting that accounts access rights for the network share and we are getting the access is denied error.
In fact I just updated my original posting with the fact that if we turn off security on the network share where this exe resides and run the same command it work successfully. However if we leave the security locked down (the domain admin of course as access) then we get access is denied as indicated.

This appears to be contrary to the way that psexec is suppose to function in this release?
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down