Print - PsExec

PsExec is a command-line tool that lets you execute processes on remote systems and redirect console applications' output to the local system so that these applications appear to be running locally. You can download PsExec for free from the Sysinternals Web site. Here are some advanced tips and tricks to help you leverage the full potential of PsExec as a systems management utility.

The PsTools Suite
PsExec is a member of Sysinternals' PsTools suite, which contains 11 tools. To be in the suite, tools must conform to a set of specifications that includes supporting Windows NT 4.0 and later, being a console application, and having the ability to work on the local system as well as on a remote one. PsTools utilities require no manual installation of software on the remote system, and they let you specify alternative credentials to access the remote system.

Incidentally, the reason that the suite is named PsTools and that all the member tools have Ps as a prefix to their name is that the first tool I developed that satisfied the listed criteria was PsList, a program that lists running processes. I named the tool after the ps utility that performs the same function on UNIX systems.

As with many of the tools in the PsTools suite, PsExec's ability to run processes remotely requires that both the local and remote computers have file and print sharing (i.e., the Workstation and Server services) enabled and that the default Admin$ share (a hidden share that maps to the \windows directory) is defined on the remote system. The reasons for these requirements will become clear later when I describe how PsExec works.

PsExec
PsExec's ability to run processes remotely with no manual installation of software on the remote system makes deployment easy. However, if PsExec were only able to launch a program on a remote system, its usefulness would be limited. PsExec's ability to redirect the input and output of console applications is what makes the tool a versatile systems management utility. Figure 1 shows PsExec's command-line options and gives a hint as to its capabilities. Many Windows administrative console tools can run only on a local machine. PsExec lets you remote-enable any of them. For example, PsExec lets Ipconfig, the Windows utility that displays the TCP/IP configuration for a system's network adapters, show a remote system's configuration. A sample command for that use is

psexec \\remote ipconfig

where remote is the name or IP address of the system you want to query. You'll see Ipconfig's output as if you had run Ipconfig on the local machine.

If you don't specify the path of the program you want to execute, PsExec looks in the \windows\system32 directory of the remote system. If you know that the program isn't in that directory, enter its full path on the remote system; if it's an executable on the local system that you want to execute on the remote system, specify the -c switch and the file's local path. The -c switch directs PsExec to copy the specified executable to the remote system for execution and delete the executable from the remote system when the program has finished running.

An even more powerful use of PsExec's console-redirection capability is to run a command prompt on a remote system as if the command prompt were running locally. This use of PsExec is similar to running a Telnet client on the local machine and connecting to a Telnet service on the remote machine, but you don't need to have the Telnet service, or any other special service, running on the remote system. Simply execute the command:

psexec \\remote cmd

If you want to execute one console command on the remote system, pass the command prompt the /c switch followed by the command you want to execute. For example, the command

psexec \\remote cmd /c ver

displays the Windows version number of the remote system on the local machine's console.

Another popular use of PsExec is to deploy hotfixes or other patches that support a noninteractive interface across your network. To make this task even easier, PsExec takes multiple computer names, the name of a text file containing a list of computer names, or the special name of \\* that results in an enumeration of all the computers in the current domain. For instance, to execute the Microsoft MyDoom removal tool on computers named Remote and Remote1 and log the exit status of the cleanup to a file, you could use the command

psexec \\remote,remote1
	-c doomcln.exe
	-s 2> results.log

Upon exit, a process specifies an integer that the process's parent process can read. Programs often use the exit code to report the success or failure of their execution. Whenever a process executed with PsExec is completed, PsExec displays the process's exit code and returns the exit code as its own exit code. You should test a program's behavior or check its documentation to determine what that program's specific error codes mean, but an exit code of 0 typically means success. The -s switch specifies that PsExec should execute the command under the System account. I'll discuss this option more in a moment.

PsExec Security
You should be aware of several ways in which PsExec interfaces with Windows security. By default, the process you execute on the remote system impersonates the account from which you run PsExec on the local system. Impersonation is somewhat restricted from the perspective of security—the remote process doesn't have access to any network resources, even those that your account typically would be able to access. If the account in which you're running doesn't have local administrative privileges on the remote system, the process you want to run requires access to network resources, or you want to run a process in a different account, then use PsExec's -u switch to provide an alternative account name. For example, you could enter the command

psexec \\remote

-u remote\administrator

-p adminpass ipconfig

to run Ipconfig under the Administrator account on the remote machine. Use the -p switch to enter the password for the account you specified with the -u switch. If you omit the -p switch, PsExec prompts you to enter the password (for security reasons, PsExec doesn't echo the password you enter to the screen).

If you specify alternative credentials, the remote process runs with those credentials and will have access to network resources that the alternative account can access. To run in a different account, PsExec must use that account to log on to the remote system. PsExec therefore requires the password on the remote system and sends the password in clear text from the local system. You need to be aware of this fact if unauthorized network sniffers could intercept traffic between the local and remote system.

You can also run the remote process in the System account, under which Windows services and core Windows processes, such as Winlogon and the Local Security Authority Subsystem Service (LSASS) are executed. The System account has powerful privileges. Some file-system and registry resources have default security settings that permit access only from the System account—examples are the HKEY_LOCAL_MACHINE\SAM registry subkey and the \System Volume Information directory that's present on each volume of all Windows 2000 or later systems.

For example, if you've ever been curious about the contents of the SAM subkey, which appears empty in regedit because regedit can navigate the subkey only under the System account, you can use PsExec similarly to the way you use the Runas command (which is available on Win2K and later) to run regedit under the System account. The command is this:

psexec -s -i

c:\windows\regedit.exe

Note that the command doesn't include a remote computer name and does include the -i (interactive) switch. When you enter the command, regedit will appear on your desktop running in the System account, and you'll be able to look inside the HKEY_LOCAL_MACHINE\SAM and HKEY_LOCAL_MACHINE\SYSTEM subkeys. The -i switch is what causes regedit to appear on the console desktop, and it's typically useful only when you want to run a GUI application on the local system where you can interact with it.

A last security note relates to viruses. Several viruses use PsExec to propagate within a network, and as a result, several major antivirus products flag PsExec as a Trojan horse program or a worm. Remember that PsExec works on remote systems only if it runs within an account that has administrator group membership on the remote system. In other words, unless the account from which you run it has administrative access to a remote system, PsExec won't be able to execute a process on the remote system. In addition, PsExec's functionality can be achieved in other ways; thus, PsExec is only a convenience for virus writers, who could otherwise easily implement the functionality that PsExec provides.

Inside PsExec
PsExec starts an executable on a remote system and controls the input and output streams of the executable's process so that you can interact with the executable from the local system. PsExec does so by extracting from its executable image an embedded Windows service named Psexesvc and copying it to the Admin$ share of the remote system. PsExec then uses the Windows Service Control Manager API, which has a remote interface, to start the Psexesvc service on the remote system.

The Psexesvc service creates a named pipe, psexecsvc, to which PsExec connects and sends commands that tell the service on the remote system which executable to launch and which options you've specified. If you specify the -d (don't wait) switch, the service exits after starting the executable; otherwise, the service waits for the executable to terminate, then sends the exit code back to PsExec for it to print on the local console.

I'd forgotten about PSExec until Mark's article reminded me. I encountered an odd problem in that any command executed, e.g. ipconfig, on a remote machine returns, "PsExec could not start cmd on remotecomputername The directory name is invalid." Seems kind of odd in that every other remote tool we use works just fine. I've been unable to find any additional information about this error. Any ideas?

We have been using PSEXEC for several years. It allows us to have a central scheduler PC run overnight batch jobs on several different machines. It given us the bases for applying security patches to our PC, atleast until we finish implementing Altiris. Want to say a HUGE thank you to Mark for all his little utils that have save my butt on more than one occasion. CHEERS

When I tried to use the PSEXEC command like "psexec -s -i c:\winnt\regedit.exe" to run REGEDIT under the System account,what returned jsut like "psexec /?".I was confused,any ideas?

For those having problems getting the PSTools to run on the remote server due to security warnings/access denied/etc., here are a couple of tips, at least for Windows XP servers: - on the server turn off "simple file sharing" - create a user on the server with the same login name and password as the person who will be running psexec. - add that user to the Administrators group on the server Very important (!): - Now that you have changed the security on the server, open Computer Management and force all sessions from this user to close (logging off doesn't always do it). Now the server will see the user connect again and use the new security settings. - Steve Yates - Too err is human. To moo, bovine. ~ Taglines by Taglinator - www.srtware.com ~

I kept getting ACCESS DENIED errors, after much googling, found that the local user account you are running psexec from cannot have a blank password. Windows wont let you run anything remotely if the account the request comes from has a blank password.

I loved this little utility that does all. what does mean when I get the following error: Defrag.exe exited on computername with error code 0? almassud@hotmail.com thanks

Usually error code zero means no error occurred. Anything above zero is an error.

Does anyone know how to get around this problem: When using psexec to run a batch file or a cmd session, if you use SET /P to set an environment variable it only uses the first letter instead of the whole line. Example code: psexec \\remote cmd.exe set /p username=Enter DB Username: Enter DB Username: Glen 'len' is not recognized as an internal or external command, operable program or batch file. set username username=G Any help or suggestions are appreciated.

Some of the CRLF's got left out of my last post there is supposed to be newline between "cmd.exe" and "set" and between "set username" and "username=G"

Sorry I wasn't more clear, I actually transfer a batch file over to the remote computer and run that, that file prompts for the password, which is supposed to be enterred by the person on the local computer. Basically it is a waste to hard-code the password because they change monthly (also bad security) and the password is required on the remote machine, not the local machine. I can get the script to run just fine, except for "Set /p" lines which never work, and only keep the first letter entered by the local user, then sends the rest of the letters to the next command. I think this must be a bug between the way psexec works and the way SET /P works because any other command can accept a string, but each call to SET /P only gets the first letter. In the batch file, if I have: SET /P USERNAME=Enter Username: SET /P PASSWORD=Enter Password: SET USERNAME SET PASSWORD If I enter Glen as the Username, the output will look like this: Enter Username: Glen Enter Password: l USERNAME=G PASSWORD=l 'en' is not recognized as an internal or external command, operable program or batch file. I hope that was a bit more clear, I added extra CRLF's in case they get stripped from this post again. I did try using quotes in different ways, basically it puts the first quote into the variable and passes the rest of the characters to the next command. If I'm running a cmd.exe remotely and I type SET USERNAME=Glen it does work, it's just the /P prompt feature which is relatively new to the SET command and maybe was not tested in psexec development.

test

I use psexec to run a batch file on the local machine as another user (which works without problems). However, after the batch has finished, psexec hangs for quite a long time until reporting that the process has finished. Is there anything one can do about that delay? Thanks in advance!

I want to use a batch file to automatically open CISCO VPN client and enter user name and password

The credentials supplied conflict with an existing set of credentials.can anyone please solve this problem

JC Warren I have the same problem here.. http://groups.google.de/groups?hl=de&lr=&selm=bitpi3%2416sf%241%40arachne.labyrinth.net.au looks like a solution here. :-)

RE: The credentials supplied conflict with an existing set of credentials.can anyone please solve this problem This usually happens when you already have a share to the computer with a different user account. For instance if your account has a share to this computer and your psexec line uses a different account. Use NET USE to list all your existing shares and DELETE the one you are trying to connect with.

psexec has gone crazy on my system. It repeats the command in an infinite do-loop until I control-c to stop the batch file. However, if I type in another psexec command, it goes right back to the "stuck" one & loops again. This behavior survives reboots. My system is still executing a psexec command that I typed in a week ago & will not recognize any new psexec command input. How do I stop it?

Anybody encountered these erros in the system event log on Windows Server 2003: The PSEXESVC service entered the stopped state. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Also these in the application event log: Reporting queued error: faulting application PSEXESVC.EXE, version 1.23.0.0, faulting module unknown, version 0.0.0.0, fault address 0x00000000. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

it's one of the best tools I've ever used. I can even read/write Windows EFS encrypted files on a remote machine from the local screen!

I'm getting "The system cannot find the file specified" when I attempt to run a vbscript. Ipconfig and other commands do run properly on the same computer.

since NAI detected PSEXESVC as a virus and tried to remove it, psexec falis to start on those servers. The windows event log reported Event ID 7000, the system can not find the file specified.

To stop that file from running until you determine the source (Scheduler? or ??) get the following program - killbox - and end the process / file. http://www.bleepingcomputer.com/files/killbox.php

Hello, can anyone help me with this error, it appears from time to time on scheduled batch scripts but when i execute the script in command prompt manually it's allways ok. psexec \\rforsap33 c:\stop_ob_portal_prd.bat PsExec v1.56 - Execute processes remotely Copyright (C) 2001-2004 Mark Russinovich Sysinternals - www.sysinternals.com The process tried to write to a nonexistent pipe. Connecting to rforsap33... Starting PsExec service on rforsap33... Connecting with PsExec service on rforsap33... Starting c:\stop_ob_portal_prd.bat on rforsap33... c:\stop_ob_portal_prd.bat exited on rforsap33 with error code 1. Tnks, jmcpinto (at) gmail (dot) com

Your context looks incorrect. Can you reply with the full context you use to invoke stop_ob_portal_prd.bat?

Whenever I try to run psexec -v (or anything else) I get an "Access is denied" message. I'm anxious to get this working so any tips would be most welcomed

very useful tool.But can any one guide me about file share and print share and how to enable/disable them

Dear thomas.mshar, We have a script on machine rforsap30 with 3 commands: psexec \\rforsap33 c:\stop_ob_portal_prd.bat psexec \\rforsap34 c:\stop_ob_portal_prd.bat cluster /cluster:PORTALCLT resource "SQLServer" /off the psexec call for rforsap33 and rforsap34 works well sometimes and fails with the error "The process tried to write to a nonexistent pipe" othertimes. I cannot find a reason for this random execution. The user is a domain user with administration authorization (same user for all machines). Thanks for your help, jmcpinto (at) gmail (dot) com

I keep getting "Access is denied" message. Could somebody please assist me? I've gone through the other comments but I dont understand them. Please help. S.M. Adam

Hello, I am using psexec from a remote computer (c code). fprintf(pt,"psexec \\\\recon1 -u administrator -p sparky -i d:\\\\reconparallel.exe\n"); fprintf(pt,"psexec \\\\recon2 -u administrator -p sparky -i c:\\\\reconparallel.exe\n"); I write this command in a file and run that file. Its working fine. The only thg is that it runs the command on recon1 1st, completes the command, and then run the command on recon2. Since the 1st command take like 6hrs to complete, I wanted to know if there is a way when it runs both the command at the same time on 2 different comouters (recon1 and recon2)? Thnaks

psexec \\mach1 -i -d -s -f -c -w C:\scripts "C:scripts\CheckoutandBuildMyApps.bat" This command works if the file does not exist on the remote machine. If the file exists, it is supposed to force copy the file (-f option) to the remote machine. It executes the older version of the script and does not state that it has failed to copy the file. Any Clues? Thanks in advance.

Hi Guys I need some help, Does anyone know what is used to separate the computer names in the text file when psexec is used with the @file parameter? I used psexec @test.txt -c “c:\test.exe” Contents of test.txt xxxpc001, xxxpc02, comma and space as separators.

PsExec rocks. What would make it rock even more is if one could specify a foreground/background color for the interactive command prompt. That way there would be a CLEAR indication that one was working on a remote system. Then when the PsExec ends, the prompt could go back to the original colors...

I am totally new to this tool, but using it to run MS patches. I choose to run this on the remote system(s) using yhe -i, and everthing starts. How do I get the patch to finish and answer the prompts ("next" Finish" etc..) If I run w/o the user intervention (-i)on the client, the psexec tool appears to hang. I assume this is because it is waitng for input. Any help would be helpful Try looking into MS patch command line options from http://unattended.msfn.org Hello, I am using psexec from a remote computer (c code). fprintf(pt,"psexec \\\\recon1 -u administrator -p sparky -i d:\\\\reconparallel.exe\n"); fprintf(pt,"psexec \\\\recon2 -u administrator -p sparky -i c:\\\\reconparallel.exe\n"); I write this command in a file and run that file. Its working fine. The only thg is that it runs the command on recon1 1st, completes the command, and then run the command on recon2. Since the 1st command take like 6hrs to complete, I wanted to know if there is a way when it runs both the command at the same time on 2 different comouters (recon1 and recon2)? Thnaks Add the word "Start" before each line, that will start a new command process for each line and continue on with the file. For @file, if I remember correctly you just list the computers, try seperating them on each line, it is probably just white space.

hi, i have the same problem than jcmpinto, the psexec command says : The process tried to write to a nonexistent pipe .... :( i call the psexec command in a java program : cmd /c C:\psexec \\10.66.X.X -u myuser -p mypasswd -i -w F:\Naming\ F:\Naming\NewTest.bat and the biginnig of the .bat is : set PATH=.;bin;..\shared\orbacus_v4.0.4_patched5;..\Imr\bin;..\utils;%PATH% set CONFIG=..\config\orbacus.config FOR /f "delims=" %%a in ('CD') DO SET CWD=%%a nameserv.exe --version 2>db\version.txt for /f "delims==" %%i in (db\version.txt) DO set l=%%i title Installation of %l% ...

Hi. Two questions. 1) In our script we map to a network drive and this line of code fails: net use x:\\networkdrive\dir x: copy .... Should this work? 2) What means "The process tried to write to a nonexistetnt pipe." message? Thanks a lot!!!

Hi weather Pstools will work only on NT Version i am using Xp is it possiable to use pstools plz send u r reply to asprabahar@gmail.com

We use PsExec as a 3rd tool with our product to remote deploy software's over the network. The command we pass to PsExec psexec \\10.10.51.26 -u 10.10.51.26\test -p test -c -f -i -e test.exe We prepend the user name with the machine when the domain name in not provided. If the domain is provided we just use the domain administrator’s user name for remote deployment. One of our customer does not wants give domain admin user and pwd. So as a test fix we remove the machine name from the user name psexec \\10.10.51.26 -u test -p test -c -f -i -e test.exe Now the remote deployement fails. Just wanted to know which is the correct option to pass to psexec if the machine is in a domain. psexec \\10.10.51.26 -u 10.10.51.26\test -p test -c -f -i -e test.exe or psexec \\10.10.51.26 -u test -p test -c -f -i -e test.exe or psexec \\\\10.10.51.26 -u test -p test -c -f -i -e test.exe

I have been using psexec with Windows 2000, but when I use it with Windows 2003 server, jobs that use mapped drives fail. See the examples below. Example 1 is a mapped network drive and Example 2 is a local drive. Is there any way I can make this work with Windows 2003? Thanks! ********* EXAMPLE 1 ************************ C:\Xformer>psexec \\transform4 -s -u administrator -p xxxxxxxxxx cmd /C dir s: PsExec v1.58 - Execute processes remotely Copyright (C) 2001-2005 Mark Russinovich Sysinternals - www.sysinternals.com The system cannot find the path specified. cmd exited on transform4 with error code 1. ********* EXAMPLE 2 ************************ C:\Xformer>psexec \\transform4 -i -u administrator -p xxxxxxxxxx cmd /C dir d: PsExec v1.58 - Execute processes remotely Copyright (C) 2001-2005 Mark Russinovich Sysinternals - www.sysinternals.com Volume in drive D has no label. Volume Serial Number is 8456-8877 Directory of d: 05/15/2005 04:28 PM