Solved

psexec error "access denied"

Posted on 2003-11-10
14
2,586 Views
Last Modified: 2013-12-23
Hi,

I am trying to execute a program remotely on another computer using psexec. Therefore I created a user account which has administrational rights on that machine. The Path to the program is known and the program does not need to be copied to that remote machine. For launching the program I use a command script which passes some arguments to the program. The program is an interactive application which should be aware of user input on the remote computer.

I tried the following commands:

psexec \\remote -u user -p pwd -e -i path\to\program.exe
psexec \\remote -u user -p pwd -e path\to\program.exe
psexec \\remote -u user -p pwd -i path\to\program.exe
psexec \\remote -u user -p pwd path\to\program.exe

Unfortunately it seems that some kind of permission has to be present for the user to execute the program since I get always the error "access denied".

Any ideas what i am doing wrong or what kind of permission i forgot?


best regards

Lars
0
Comment
Question by:califax
  • 4
  • 4
  • 2
  • +2
14 Comments
 
LVL 1

Expert Comment

by:lacams
ID: 9714683
Is the domain of the username that you use, the same domain than your account ?

Else used :
psexec \\remote -u "domain\user" -p "pwd" path\to\program.exe

christophe
0
 

Author Comment

by:califax
ID: 9715391
The target machines are not members of a domain. They are just connected via a crossed ethernet cable and are members of a workgroup. This is why I tried using the name of the computer instead of a domain name. The machines are fsc1 and fsc2. On both machines there exists a user account "herbert" which has administrative rights (e.g. it is member in the administrators group). When I tested from fsc1, I used:

psexec \\fsc2 -u FSC2\herbert -p herbertsPW -e command

This always gave me the result "access denied".


Lars
0
 
LVL 2

Expert Comment

by:Gal
ID: 9716375
I would guess that the passwords on the two machines are different for their respective users?
My suggestion: do not use the same user name for both. use something else for the second machine.
Otherwise, use the same password for that username on both machines. this will also do the trick (although much less secure, which I guess is not a problem here, since you got the machines crosswired).

Since you are logged in as herbert on the first machine, and already have a connection to the second machine with that name, what happens when you execute something on the 2nd machine, with the same username in the parameter (even with a different  domain/computer name), is that windows will disregard the domain/computer part and only take the username part. therefore, since those accounts have different passwords, you get the access denied.
this is by design of the authentication algorithm, as far as I can remember it..
Hope it helps.
Ciao,
ZG.

0
 

Author Comment

by:califax
ID: 9720656
I understand what you're saying. unfortunately the passwords are the same.

Maybe I should have said this earlier. I am using Windows XP Pro. Could it be that the authentication scheme has changed there?

sry, if this has been a crucial information.

thanks,

Lars
0
 
LVL 1

Expert Comment

by:lacams
ID: 9720847
Have you tried without username informations ?

psexec \\fsc2 command

chris
0
 

Author Comment

by:califax
ID: 9720957
yes, I tried that too


Lars
0
 
LVL 1

Expert Comment

by:lacams
ID: 9721332
what is the command that you used ?

chris
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 1

Expert Comment

by:lacams
ID: 9721897
to be sure that is a psexec problem : Have you tried to run this command ?

(it's necessary that a user are logged on the target computer)
psexec \\fsc2 explorer.exe

If it works, could you check your command.exe(be careful if this command must be used with an specially account)

chris
0
 
LVL 2

Expert Comment

by:Gal
ID: 9733566
Hi again,
I've re-read the whole thing, and it seems to me that we've overlooked something, so let's go to the basics:
1. both machines are wxp, in a workgroup, right?
2. both machines have a username herbert, same pwd, on them, with admin rights.
3. you're logged on as herbert on machine1
If I'm right so far then let's try the following:

1. try to connect to machine2's c$.  this will show you if ou have admin rights on the other machine too.
if you can, we're good, and you can try that psexec again (with the connection intact).
2. if you can't (as I suspect), then you simply don't have perms on the second machine... put machine1\herbert in the adminsgroup of machine2... then try again

As far as psexec: the way it actually works, is that it installs a service on machine2, then that service runs yor command using the RunAs api... Now,assuming I'm correct, if you're not admin on machine2, the Access denied error actually comes from failing to install the service, not running the cmmand itself.

Sorry for the long comments.... :)
good luck.
ZG
0
 
LVL 37

Expert Comment

by:Bing CISM / CISSP
ID: 9939816
use "psexec -s" with your other parameters, that it goes fine.
0
 
LVL 37

Expert Comment

by:Bing CISM / CISSP
ID: 9979642
califax, are you here with us? i am VERY sure that "psexec -s" is your solution, just have a try.
0
 

Expert Comment

by:cjwjordan
ID: 10190321
I am having the same problem.  I don't think it is anything to do with pstools/psexec.  I cannot connect to Computer Management on the affected machines either.  Some suggestions that have worked for other people have included looking at firewall setings to see if they let RPC through.  You could also try permissions on the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg key (see question 20755493 at http://www.experts-exchange.com/Operating_Systems/WinXP/Q_20755493.html).  These haven'y worked for me, but they were good ideas.
0
 

Accepted Solution

by:
cjwjordan earned 200 total points
ID: 10190569
Just fixed it -- Windows XP enables Simple File Sharing by default.  It treats all network users as Guest accounts.  Because of this you get Access Denied messages for a range of things including pstools, accessing C$ shares and remotely operating Computer Management. When I disabled it it all started working.   You can find it in Folder Options at the bottom of the view tab.
0
 

Author Comment

by:califax
ID: 10197375
Great. This solved the problem immediately ;) I thank all you guys very much for your help. (@bbao: I was with you all the time ;)
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Internet Speed Test 5 70
Systems Enngineer 8 57
Weird Issues with AD GPOs 5 76
internet access from windows servers 4 55
FIPS stands for the Federal Information Processing Standardisation and FIPS 140-2 is a collection of standards that are generically associated with hardware and software cryptography. In most cases, people can refer to this as the method of encrypti…
Resolve DNS query failed errors for Exchange
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now