Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am using psexec.exe to run programs in a different security context. However the programs start but it does not seem to be running in the specified security context.

In its minimal form:

psexec -u wsadmin -p password cmd

Starts a new cmd window if I type in that window whoami

C:\Windows\system32>whoami
win-k1r7g38nlkt\wsadmin

C:\Windows\system32>net localgroup administrators
Alias name     administrators
Comment        Administrators have complete and unrestricted access to the computer/domain

Members

-------------------------------------------------------------------------------
Administrator
wsadmin
The command completed successfully.

As you can see I am definately the other user. And I can confirm that this user is member of the "Administrators group"

C:\Windows\system32>mkdir test
Access is denied.

If I use runas with the specified user it works as supposed. But I need to supply the password on the commandline.

share|improve this question

3 Answers 3

On Windows Vista and later, if UAC is enabled, a process launched by psexec -- even when run from an administrator account -- must have its elevate token set in order to get full privileges. This can be done by passing the -h attribute in the psexec command line. So, you would change your command to:

psexec -h -u wsadmin -p password cmd

For more info, run psexec /?:

    -h    If the target system is Vista or higher, has the process
          run with the account's elevated token, if available.
share|improve this answer
1  
Unfortunately this gives me "Couldn't install PSExec service access is denied" –  Tuim Jan 28 '13 at 10:39
    
Are you also running the initial command from an elevated command prompt, or are you using it as a local run-as? –  nhinkle Jan 28 '13 at 11:02
    
The original command runs a 'user' security context. I can not use run-as for specific reasons. –  Tuim Jan 28 '13 at 11:20
    
Thank you! I spent a week trying to figure this out.. –  Simon Ejsing Nov 5 '13 at 20:31
up vote 0 down vote accepted

I have found a solution:

Turns out that when you have UAC enabled psexec does not work as supposed.
Whenever HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA is set to 0 psexec works as expected.

share|improve this answer
    
The other way around this that doesn't require changing the registry is to just add the -h flag to the psexec command. This tells it to run the command with the elevated token, which is equivalent to launching a process "as administrator" from the context menu. –  nhinkle Jan 28 '13 at 10:09
    
I will have to try this! –  Tuim Jan 28 '13 at 10:11
    
Setting EnableLUA to 0 disables Admin Approval Mode, which is basically the core of UAC. As a result the UAC will get disabled. Source. –  Vlastimil Ovčáčík Jul 27 '13 at 13:06

It took me hours to find a working way to PsExec between two Windows 7 Computers with non-Admin user starting PsExec ... Disabling UAC (EnableLUA=0, ConsentPromptBehaviorAdmin=0, LocalAccountTokenFilterPolicy=1) did not work, turning off the Firewalls did not work...

Here I found the working way - thanks JelmerS: (Info from PSexec is not connecting to machine using supplied username and password)

This is because psexec still tries to access the ADMIN$ share with your local credentials, before executing your command as another user. According to this thread, you can cache credentials before executing psexec:

cmdkey.exe /add:MACHINE_NAME_HERE /user:MACHINE_NAME_HERE\Administrator /pass:PASSWORD_HERE 
psexec.exe \\MACHINE_NAME_HERE -i notepad
cmdkey.exe /delete:MACHINE_NAME_HERE
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.