PSEXEC - Access is denied - remote admin credentials

Posted on 2010-04-06
Medium Priority
Last Modified: 2012-05-09
I'm trying to open a command prompt on a remote server (Windows 2008 server).  As I understand it, I must have admin rights on the remote machine, but it only works when logged in as an admin user on the local machine (2003).  If I login as a standard user on the local machine PSEXEC fails with "Access is denied".

The command is:
psexec \\servername -u username -p password cmd.exe

Any help appreciated.
Question by:markserv
LVL 10

Expert Comment

by:Michael Ian Claridge
ID: 29890326
That is correct, PSEXEC is to be launch with elevated rights, in addition to this PSEXEC is also to be copied to the SYSTEM32 folder on the remote server.
I know it works because i use it :)
I hope this helps.
LVL 30

Expert Comment

ID: 29890817
LVL 10

Expert Comment

by:Michael Ian Claridge
ID: 29891153
From a run prompt you can also launch cmd locally as an admin on a remote server using the below:-
runas /user:DOMAIN\USER cmd
When this is running as the Administrative account, you can then use PSEXEC and launch CMD without further usernames or passwords.

Expert Comment

ID: 29953878
Assume that you are currently sitting at, or logged in to the local computer, computer A.  You want to use psexec to run a process on computer B which is the remote computer.

First step:
psexec is a program and runs locally on computer A.  It has to execute to be able to do it's fun remote magic.  So it will run as the locally logged on user unless you do run it special like using runas as MichaelIanClaridge posted above.  If the user running psexec doesn't have the correct permissions to run psexec as a program locally then you will be denied permission.

psexec runs on computer A, but connects and starts to make changes to computer B.  When connecting to computer B psexec will use the current user account running psexec, or the user specified by the psexec "-u domain\user" parameter if it was supplied.  This means psexec needs to either be running on computer A as a user with admin rights to computer B or needs to have been started with the -u parameter to specify an admin user on computer B.  If not, you will also get permission denied.

If you wanted to copy the text in your command prompt when you try to run psexec we can help pinpoint where the issue is and help provide the correct solution.  Right click in the command window, select "Mark".  Then highlight the text and right click to copy it to the clipboard.  Then you can paste it here.

Accepted Solution

markserv earned 0 total points
ID: 29967035
Thanks everyone for your input.  I can't seem to get 'runas' to work, but in any case it probably isn't suitable as I want non-admin users to open a command prompt on a remote server.  Let me explain further.  We use Windows 2003 Terminal Services (TS) for our desktop environment, but users run CPU intensive batch jobs that slow down the TS machine, so I want these batch jobs to run on another server.  Currently users open a command prompt under their TS login and execute batch files, so I was hoping to emulate this using PSexec - which would open a command prompt on the remote server and use a network share to access the same disk users see under their TS session.  I don't want the users to have admin rights, so at the very least I need to hide admin password from users.  If PSexec can't achieve this, are there any other solutions?

Featured Post

Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Understanding the various editions available is vital when you decide to purchase Windows Server 2012. You need to have a basic understanding of the features and limitations in each edition in order to make a well-informed decision that best suits …
A procedure for exporting installed hotfix details of remote computers using powershell
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…

627 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question