Sysinternals Homepage
Forum Home Forum Home > Sysinternals Utilities > PsTools
  New Posts New Posts RSS Feed - PsExec - No Process on the other end of the pipe
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

PsExec - No Process on the other end of the pipe

 Post Reply Post Reply Page  123>
Author
Message
SnipeyX View Drop Down
Newbie
Newbie


Joined: 31 December 2007
Status: Offline
Points: 6
Post Options Post Options   Thanks (0) Thanks(0)   Quote SnipeyX Quote  Post ReplyReply Direct Link To This Post Topic: PsExec - No Process on the other end of the pipe
    Posted: 31 December 2007 at 2:05pm

"No Process is on the other end of the pipe" - I am receiving this error on more and more machines lately and don't know why.

I am using a simple psexec to execute a program remotely across a variety of different machines. For the past couple months this has worked fine on a select few, and now that I am expanding across more machines (and have recently upgraded versions of pstools) I am running into more that have this error, and even some that this has worked on previously are now getting this error as well.

I can run the 3 test commands in FAQ fine and I can even use pskill correctly on these machines, but for some reason psexec won't let me start anything because of this error.

Any ideas on what I should look at?
Back to Top
Karlchen View Drop Down
Senior Member
Senior Member
Avatar

Joined: 18 June 2005
Location: Germany
Status: Offline
Points: 5156
Post Options Post Options   Thanks (0) Thanks(0)   Quote Karlchen Quote  Post ReplyReply Direct Link To This Post Posted: 01 January 2008 at 2:17am
Happy New Year, SnipeyX.

There are only two or three other (old) threads reporting this error. Sadly none of these threads offers any explanation or solution.

Searching for "No process on the other end of the pipe" in the web yields a number of references to MS KB articles. Yet, they all are about MS SQL. The problem seems to occur if clients try to establish an encrypted connection to the MS SQL server and if the clients use outdated certificates. (Hope I got this right.)

I wonder if the same might apply to psexec in your case. psexec will
+ extract psexesvc on the local machine
+ copy it to ADMIN$ on the remote machine
+ launch it on the remote machine as a temporary service
+ establish named pipes between psexesvc.exe and psexec.exe

Maybe in your case, something on the remote machine makes psexesvc.exe exit before the pipes have been established.

You might logon to one of the remote machines where you receive the error and monitor what happens with the help of Process Explorer or maybe even Process Monitor. You might also check the eventlogs on the remote machine. The SYSTEM tab should at minimum document that psexesvc is launched and terminated. Maybe other entries will indicate errors. Also have a look at the APPLICATIONS tab.

Maybe, the following 2 MS KB articles are helpful, although taken from a thread where a different error messages was displayed by psexec:
+ Changes to null session pipes post 2k3 SP1 (Win2003 Sp1)
+ How to Manage Remote Access to the Registry (WinXP).

Kind regards,
Karl

Back to Top
SnipeyX View Drop Down
Newbie
Newbie


Joined: 31 December 2007
Status: Offline
Points: 6
Post Options Post Options   Thanks (0) Thanks(0)   Quote SnipeyX Quote  Post ReplyReply Direct Link To This Post Posted: 01 January 2008 at 6:19am
Thanks for the awesome response Karl, I will definitely look into that stuff as I have time and will try to report back anything I come across.

I had done the same searching on the forum and google regarding that error, and since I'm no networking expert and know nothing about SQL, I pretty much just glazed over those results.

Regarding the extraction of the psexesvc on the remote machine, is there any possibility that switching between different versions of psexec would have 'corrupted' the psexesvc on the remote machine? You said it's temporary though, so does the psexesvc only last for the few seconds you're running the command?

Thanks again for the troubleshooting leads...


...and Happy New Year to everyone as well!
Back to Top
Karlchen View Drop Down
Senior Member
Senior Member
Avatar

Joined: 18 June 2005
Location: Germany
Status: Offline
Points: 5156
Post Options Post Options   Thanks (0) Thanks(0)   Quote Karlchen Quote  Post ReplyReply Direct Link To This Post Posted: 01 January 2008 at 6:41am
Hi, SnipeyX.

About psexesvc.exe and the temporary psexesvc service on the target machine:
Right. They should be removed automatically as soon as they are no longer needed. This works fine most of the time.
Yet, there have been reports where psexesvc.exe had not been removed on the target machine (folder: %windir%). If such a leftover psexesvc.exe is older than the psexec.exe which tries to use it, this will lead to trouble. (cf. e.g. here.)
So checking whether an old psexesvc.exe still exists inside %windir% (ADMIN$) on a failing target machines may be worth a try.

Regards,
Karl
Back to Top
SnipeyX View Drop Down
Newbie
Newbie


Joined: 31 December 2007
Status: Offline
Points: 6
Post Options Post Options   Thanks (0) Thanks(0)   Quote SnipeyX Quote  Post ReplyReply Direct Link To This Post Posted: 06 January 2008 at 2:24pm
Update on this, I haven't had a chance to dig very deeply into with some of the tools you mentioned in your first response Karl, but this afternoon a handful of the machines that were giving me this message a week ago, have seemingly randomly started working again. This isn't the first time this has happened on a couple of the machines, which is leading me to believe that it has something to do with what kind of state the remote machine is in, or something.
 
There are still a couple machines that are always giving me this error, so I will look at those more in-depth, but I thought it was worth mentioned that it seems to have fixed itself without me doing anything.
 
(Note: I work in a large firm where the computers I am controlling have a variety of different users that could potentially be doing things on these machines that are causing this to break/fix, so I'm not ruling out the possibility that there is someone else changing settings or something that would affect my ability to run psexec....)
Back to Top
Karlchen View Drop Down
Senior Member
Senior Member
Avatar

Joined: 18 June 2005
Location: Germany
Status: Offline
Points: 5156
Post Options Post Options   Thanks (0) Thanks(0)   Quote Karlchen Quote  Post ReplyReply Direct Link To This Post Posted: 06 January 2008 at 3:09pm
Hello, SnipeyX.

Thank you for your update on the issue. - I am eager to learn whether we will be able to get to the bottom of the issue in the end and solve it....

Regards,
Karl
Back to Top
SnipeyX View Drop Down
Newbie
Newbie


Joined: 31 December 2007
Status: Offline
Points: 6
Post Options Post Options   Thanks (0) Thanks(0)   Quote SnipeyX Quote  Post ReplyReply Direct Link To This Post Posted: 06 January 2008 at 4:29pm
Alrighty, I'm getting familiar with ProcessMonitor now, and I've created filters on the local & remote machine to only display info when the process name contains PSEXE  in order to get both psexec.exe and psexesvc.exe on both machines.
 
Everything on the remote machine results in success (according to the result column of process monitor.)
 
Next I started comparing the results on my local machine for when psexec works on a remote machine and when it fails on a remote machine.
 
On the successful execution, Procmon returns 341 events, on failed execution procmon returns 496 events.
 
Without being able to understand much of what I'm looking at, the first thing that jumps out at me while comparing the two directly, is immediately after reading from the C:\windows\prefetch\psexec.exe-3B6D147E.pf  file the working and failing procmon events part paths. The working events next query the registry and load kernel32.dll while the failing events start querying my C drive, then C:\windows, then C:\windows\system32, then C:\windows\winSxS, then open and query a bunch of different dll files in those folders, then goes through and closes those files, and then continue on to load the image for kernel32.dll and moves forward from there.
 
Does that make a difference? Or is there any clue you could give me as to what I should look for while inspecting the events in procmon? (on either remote or local machine)
 
Thanks again for the help.
 
 
 
Back to Top
SnipeyX View Drop Down
Newbie
Newbie


Joined: 31 December 2007
Status: Offline
Points: 6
Post Options Post Options   Thanks (0) Thanks(0)   Quote SnipeyX Quote  Post ReplyReply Direct Link To This Post Posted: 06 January 2008 at 4:44pm

You can probably disregard the last post, I think I've found what is breaking it. Not sure why, but I can fix/break it at will now.

After a fresh reboot, and no one logging in to the machine, psexec works.
 
But if you reboot, then try logging in via remote desktop, psexec does not work. And it continues to not work, even after I log out of remote desktop, until I reboot the machine.
 
I am able to duplicate this across several machines right now, though all are running windows xp pro sp2. For what it's worth, when I remote desktop, I am using a different username than the credentials I am specifying in psexec.
 
Am I doing something wrong?
Back to Top
Karlchen View Drop Down
Senior Member
Senior Member
Avatar

Joined: 18 June 2005
Location: Germany
Status: Offline
Points: 5156
Post Options Post Options   Thanks (0) Thanks(0)   Quote Karlchen Quote  Post ReplyReply Direct Link To This Post Posted: 07 January 2008 at 3:24pm
Hi, SnipeyX.

I use RDP a lot in order to connect from WinXP SP2 machines to a bunch of different Windows server systems.
So far I have never noticed that having used RDP might have any effect on psexec.
Telling from your report, I may just have been lucky it has not done so here.
So as a matter of fact, you see me clueless at the moment. I cannot explain what RDP might do to prevent psexec from working.

Karl
Back to Top
JerryWang View Drop Down
Newbie
Newbie
Avatar

Joined: 08 January 2008
Location: United States
Status: Offline
Points: 2
Post Options Post Options   Thanks (0) Thanks(0)   Quote JerryWang Quote  Post ReplyReply Direct Link To This Post Posted: 08 January 2008 at 10:43am
In my case, there is another psexesvc.exe at c:\windows of different size and it may be older or newer version. I just "sc.exe delete psexesvc" to get rid of that one and rerun psexec to the host and it solved my problem.
 
Jerry
Back to Top
 Post Reply Post Reply Page  123>
  Share Topic   

Forum Jump Forum Permissions View Drop Down

Forum Software by Web Wiz Forums® version 11.06
Copyright ©2001-2016 Web Wiz Ltd.