PSEXEC, access denied errors

Question

While I'm using PSEXEC.exe getting 'Access denied' error for remote systems.

Any idea about how to solve this?

I am also having this problem, but none of the solutions here or elsewhere have worked for me, as of 5/31/20. — David Spector, Jun 01 '20 at 00:18

score 79 · Answer 1 · edited Feb 07 '18 at 00:16

79

Hi i am placing here a summary from many sources online for various solutions to "access is denied" : most information can be found here (including requirements needed) - sysinternal help

as someone mentioned add this reg key, and then restart the computer :

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

Read this knowledge base article to learn what this does and why it is needed
Disable firewall (note - this will leave you with out any firewall protection)

netsh advfirewall set allprofiles state off
if target user has a blank PW and you dont want to add one, run on target:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "LimitBlankPasswordUse"=dword:00000000
This didnt work for me, but i have read it did for others in a few places, on target execute:

Start -> Run -> secpol.msc -> Local Policies -> Security Options -> Network Access: Sharing > and security model for local accounts > Classic – local users authenticate as themselves

if already in 'Classic':

move to "Guest only - .." run from elevated command prompt gpupdate \force move back to 'Classic - .." again run from elevated command prompt gpupdate \force
This one solved my issue:

run on target from elevated command prompt "net use" look at ouput chart and for shares listed in remote column there (i only deleted the disconnected ones - you can try them all) run "net use [remote path from before list] /delete" then run 'net use \target\Admin$ /user:[user name]' enter prompt password request (if empty PW just press enter), viola should work.

good luck, hope this saves someones time.

edited Feb 07 '18 at 00:16

RK Coder

379
1
13

answered Dec 31 '12 at 16:05

james

1,672
1
16
26

2

1) help me (also, semi-related, needed to fully qualify username with target server name since user was local to target server) – Straff Oct 06 '13 at 09:40
4) worked for me when connect my windows 7 to a windows virtual pc XP Mode. Thanks! – bxx Nov 19 '13 at 03:21
Go to Files and Folders. -> View -> Scroll down to disable "Simple File Sharing" ON THE TARGET machine. That worked for me. I tried all the others first. including 5, which just reported Server not enabled for remote administration – twobob May 07 '17 at 02:11
The sysinternals help link which was http://forum.sysinternals.com/topic15919.html now reports "The Windows Sysinternals Forums have moved to TechNet Forums" and redirects in 10 sec, except not to the post, but to some generic list "category=sysinternals&sort=lastpostdesc". The "psexec could not start" post is now here: https://social.technet.microsoft.com/Forums/en-US/0f02208a-feae-4914-9f2d-56c2d71484f9/psexec-could-not-start?forum=pstools and the first reply self-attributed to Karl contains the minimum requirements. – john v kumpf Feb 27 '19 at 22:15
Also, the "FAQ" post has moved to here: https://social.technet.microsoft.com/Forums/en-US/8761bf03-8c05-493e-93b1-497f97ce9436/-faq-common-pstools-issues-?forum=pstools – john v kumpf Feb 27 '19 at 22:17
1

I know this is old, but #1 did the trick for me on Windows 10,(Both machines) – Simon Goodman Mar 23 '19 at 06:37
@twobob: I could not find "simple file sharing" anywhere on the target computer, in settings or control panel. – David Spector May 31 '20 at 22:38
@DavidSpector hmm yeah. I too can no longer find those settings in windows 10. It used to be here https://helpdeskgeek.com/wp-content/pictures/2008/10/disablesimplefilesharing.png.webp I suspect they renamed it to "Use Sharing Wizard (Recommended)" which in my case if OFF. They have shuffled the order a bit but that's still roughly in the same place give or take some fluff. Hope that's it for you buddy. – twobob Jun 05 '20 at 17:09

score 23 · Answer 2 · edited Feb 25 '21 at 20:19

23

I just solved an identical symptom, by creating the registry value HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\LocalAccountTokenFilterPolicy and setting it to 1. More details are available here.

edited Feb 25 '21 at 20:19

tresf

3,691
3
26
78

answered Dec 25 '11 at 15:20

Ofek Shilon

11,558
3
52
86

2

Yup, worked here. Thanks! To be extra clear, that must be a `REG_DWORD` key. – underscore_d May 30 '17 at 10:28
Thanks, I put his content in a .reg file and voila:
`code` Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] "LocalAccountTokenFilterPolicy"=dword:00000001`code` – frss-soft.com Sep 26 '20 at 04:32

score 11 · Answer 3 · edited Oct 15 '15 at 10:05

11

This helped in my case:

cmdkey.exe /add:<targetname> /user:<username> /pass:<password>
psexec.exe \\<targetname> <remote_command>

edited Oct 15 '15 at 10:05

spenibus

4,079
11
23
33

answered Oct 15 '15 at 09:45

akash bhatia

111
1
2

1

Thanks Man, This work for me and it looks like the least complicated way to do it !!! – Pini Cheyni Jun 23 '16 at 13:37
1

The reference link changed from http://forum.sysinternals.com/psexec-access-denied-when-using-explicit-logon_topic17497.html to https://social.technet.microsoft.com/Forums/en-US/efd64118-93c0-43ec-ba41-b2cd89ddfbd8/psexec-access-denied-when-using-explicit-logon?forum=pstools – john v kumpf Feb 28 '19 at 04:14
Did not work for me. The 'access denied' problem doesn't seem to be the credentials. – David Spector May 31 '20 at 22:45

eran · Answer 4 · 2019-02-28T10:32:57.230

11

PsExec has whatever access rights its launcher has. It runs under regular Windows access control. This means whoever launched PsExec (be it either you, the scheduler, a service etc.) does not have sufficient rights on the target machine, or the target machine is not configured correctly. The first things to do are:

Make sure the launcher of PsExec is familiar to the target machine, either via the domain or by having the same user and password defined locally on both machines.
Use command line arguments to specify a user that is known to the target machine (-u user -p password)

If this did not solve your problem, make sure the target machine meets the minimum requirements, specified here.

edited Feb 28 '19 at 10:32

answered May 06 '09 at 08:37

eran

20,710
4
52
86

1

The "minimum requirements" post (reply) link which was http://forum.sysinternals.com/forum_posts.asp?TID=15919 now reports "The Windows Sysinternals Forums have moved to TechNet Forums" and redirects in 10 sec, except not to the post, but to some generic list "category=sysinternals&sort=lastpostdesc". The "psexec could not start" post is now here: https://social.technet.microsoft.com/Forums/en-US/0f02208a-feae-4914-9f2d-56c2d71484f9/psexec-could-not-start?forum=pstools and the first reply self-attributed to Karl contains the minimum requirements. – john v kumpf Feb 27 '19 at 22:19
Thanks, @johnvkumpf. Fixed the link according to your suggestion, glad you see it's still helpful 10 years after the original post. Feel free to suggest an edit to the answer next time (instead of commenting, you can actually fix the answer). – eran Feb 28 '19 at 10:35
2

The link is now dead. – David Spector May 31 '20 at 22:41

score 6 · Answer 5 · edited Oct 11 '12 at 19:52

6

You can try the command

net use \\computername\ipc$ /user:adminname password

to get admin permissions on remote PC before use psexec.

edited Oct 11 '12 at 19:52

Uwe Keim

36,867
50
163
268

answered Jul 07 '12 at 03:45

Lim Yee Fatt

71
1
1

When I run this command I get: "The command completed successfully." What's the purpose of running this command? – demonicdaron Feb 26 '19 at 12:08

Wernight · Answer 6 · 2015-11-19T10:21:00.663

5

Try setting this key on the target (remote) machine, and restart the machine:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"LocalAccountTokenFilterPolicy"=dword:00000001

See: http://forum.sysinternals.com/topic10924.html and http://www.brandonmartinez.com/2013/04/24/resolve-access-is-denied-using-psexec-with-a-local-admin-account/

edited Nov 19 '15 at 10:21

answered Sep 05 '12 at 11:04

Wernight

32,087
22
110
128

score 5 · Answer 7 · answered Sep 26 '14 at 18:42

I had the same problem. And after a hard work, I found a easy and full solution:

I use runas to run the script in a admin account
I use the -s parameter in psExec to run in a system account
Inside the PsExec, I login again with a admin account
You can use & to run multiples commands
Remember to replace [USERNAME], [PASSWORD], [COMPUTERNAME], [COMMAND1] and [COMMAND2] with the real values

The code looks like this:

runas /user:[USERNAME] "psexec -e -h -s -u [USERNAME] -p [PASSWORD] \\[COMPUTERNAME] cmd /C [COMMAND1] & [COMMAND2]"

If you whant to debug your script in the another machine, run the following template:

runas /user:[USERNAME] "psexec -i -e -h -s -u [USERNAME] -p [PASSWORD] \\[COMPUTERNAME] cmd /C [COMMAND1] & [COMMAND2] & pause"

When I right-click my cmd file in Explorer and select Run as Administrator, I still get 'access denied'. — David Spector, May 31 '20 at 23:02

score 4 · Answer 8 · answered Apr 29 '13 at 06:38

4

I just added "-с" parameter. It makes Psexec copy executable to remote machine. So it works without access errors.

answered Apr 29 '13 at 06:38

Dan

41
1

Okay, but it seems wasteful to keep copying system commands that are already there on the remote computer. – David Spector May 31 '20 at 23:03

score 3 · Answer 9 · answered Mar 12 '14 at 21:16

3

I found Sophos kept placing psexec.exe into the Quarantine section. Once I authorized it, it ran fine.

answered Mar 12 '14 at 21:16

UsPeoples

61
1
3

score 2 · Answer 10 · answered Apr 08 '13 at 11:43

2

I had a case where AV was quarantining Psexec - had to disable On-access scanning

answered Apr 08 '13 at 11:43

b33llz

21
1

score 2 · Answer 11 · edited Nov 11 '16 at 10:34

2

I still use psexec, even on win 10. Replace the psexec.exe in the Windows 10's win32 folder with the older version to work -> I use version 2.11.0.0. The Windows 10 version I was using would only run .bat files as background/hidden process on the remote computer. Took a whole day to figure this out.

Adding the registry key from above to the remote computer helps as well:

   reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

edited Nov 11 '16 at 10:34

answered Nov 11 '16 at 07:39

tmasher

21
1

As a 2016 answer to a 2009 question, I'm not sure what more this adds since the registry key is already well documented in the previous answers. – David Hoelzer Nov 11 '16 at 10:41

score 2 · Answer 12 · answered Jan 17 '12 at 14:57

I found another reason PSEXEC (and other PS tools) fail - If something (...say, a virus or trojan) hides the Windows folder and/or its files, then PSEXEC will fail with an "Access is Denied" error, PSLIST will give the error "Processor performance object not found on " and you'll be left in the dark as to the reason.

You can RDP in; You can access the admin$ share; You can view the drive contents remotely, etc. etc., but there's no indication that file(s) or folder(s) being hidden is the reason.

I'll be posting this information on several pages that i was perusing yesterday while trying to determine the cause of this odd problem, so you might see this elsewhere verbatim - just thought I'd put the word out before anyone else pulled their hair out by the roots trying to understand why the performance counter has anything to do with PSEXEC running.

You're giving what is perhaps good, accurate info, but on the wrong question. — Orangutech, Apr 16 '13 at 19:01
I excluded my PSTOOLS directory from my antivirus program (Malwarebytes) and still got 'access denied'. — David Spector, May 31 '20 at 23:07

score 1 · Answer 13 · answered Jan 15 '14 at 21:45

For anybody who may stumble upon this. There is a recent (Dec 2013) Security Update from Microsoft Windows on Windows 7 that is preventing remote execution. See http://support.microsoft.com/kb/2893294/en-us

I uninstalled the Security Update by going to Control Panel\Programs\Programs and Features\Installed Updates

It worked right after that.

score 1 · Answer 14 · edited Apr 01 '14 at 13:23

1

The following worked, but only after I upgraded PSEXEC to 2.1 from Microsoft.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] "LocalAccountTokenFilterPolicy"=dword:00000001 See: http://forum.sysinternals.com/topic10924.html

I had a slightly older version that didn't work. I used it to do some USMT work via Dell kace, worked a treat :)

edited Apr 01 '14 at 13:23

jww

83,594
69
338
732

answered Apr 01 '14 at 13:01

ma034001

11
1

I have PSEXEC 2.2, but adding this key and value did not help. – David Spector May 31 '20 at 23:11

score 1 · Answer 15 · edited Jul 20 '16 at 13:49

1

On Windows Server 2012 R2 I had trouble to run from user account

psexec -u administrator -p password \\machinename -h -s -d -accepteula cmd.exe

But it works fine if you run without parameters -h -s. That's why I use this to solve my trouble:

psexec -accepteula -u administrator -p password \\machinename %PathToLocalUtils%\psexec.exe -h -s -d  cmd.exe

edited Jul 20 '16 at 13:49

mnille

1,332
4
13
17

answered Jul 20 '16 at 13:01

Борис Иванов

39
3

score 0 · Answer 16 · edited May 24 '18 at 13:15

0

I couldn't get access to remote machines unless I had UAC disabled.

That has to be done locally, either from control panel or running the following through cmd:

reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

While UAC is enabled, make sure you run cmd as administrator.

edited May 24 '18 at 13:15

pringi

1,369
3
19
26

answered May 24 '18 at 12:21

Dmitry

1

Erro I got : Microsoft Web Driver can't be used with the Built-In Administrator account or while User Account Control is turned off. – Mike ASP Jun 04 '18 at 20:20

score 0 · Answer 17 · edited Jun 29 '18 at 20:23

0

For a different command I decided to change the network from public to work.
After trying to use the psexec command again it worked again.
So to get psexec to work try to change your network type from public to work or home.

edited Jun 29 '18 at 20:23

geisterfurz007

3,390
5
29
46

answered Jun 29 '18 at 09:01

Omega Wu

1

score 0 · Answer 18 · answered Mar 27 '20 at 21:47

I tried a lot of way but I could not use psexec. It gives "Access denied". After I change the target user account type from Standard to Admin, I connected the machine via psexec.

I researched the reason why admin type account is required then I found this answer.

You can change target machine user account this way: Control Panel -> User Accounts -> Change Account Type. You must enter an admin account and password to change that account if you logged in standard account.

After that I logged in with this command: psexec \\remotepcname -u remoteusername -p remotepassword cmd

PSEXEC, access denied errors

18 Answers18

Linked

Related