How to use the command 'psexec' (with examples)

PsExec is a powerful system administration tool from Microsoft’s Sysinternals Suite that allows users to execute processes on remote machines. This utility is widely used for automation tasks, troubleshooting, obtaining system information, and administering large networks. However, PsExec should be used judiciously, as it has the potential to be dangerous if misused or if executed without proper permission or security considerations.

Use case 1: Execute a command using cmd in a remote shell

Code:

psexec \\remote_host cmd

Motivation:

This use case demonstrates how to initiate a remote shell session on a target machine, enabling you to run various command-line utilities as if you were physically sitting at the computer. This can be particularly useful for administrators who need to inspect, update, or troubleshoot remote machines without physically visiting the site.

Explanation:

• \\remote_host: This specifies the network name or IP address of the remote machine where the command will be executed.
• cmd: This is the command interpreter for Windows. By providing cmd, you’re specifying that you wish to start an interactive command-line session on the remote machine.

Example Output:

When executed, this command opens a remote command shell. An administrator might see a command prompt similar to this:

Microsoft Windows [Version 10.0.19044.1288]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\system32>_

Use case 2: Execute a command on a remote host (pre-authenticated)

Code:

psexec \\remote_host -u user_name -p password

Motivation:

This example allows administrators to authenticate and execute commands on a remote system using specific user credentials. This is essential when managing systems across domains or securing administrative actions by specifying explicit credentials rather than relying on the current user context.

Explanation:

• \\remote_host: Indicates the target machine.
• -u user_name: This flag specifies the user identity under which the command should be executed on the remote machine.
• -p password: Provides the password for the specified user. It’s a good practice to ensure secure handling of credentials.

Example Output:

If successful, PsExec will authenticate the user and execute the specified command while displaying any resultant output or errors in the local console window.

Connecting to \\remote_host...
Starting PSEXESVC service on \\remote_host...
PSEXESVC service started on \\remote_host with process ID ...

Use case 3: Execute a command remotely and output the result to a file

Code:

psexec \\remote_host cmd /c command -an ^>path\to\file.txt

Motivation:

Redirecting command output to a file on a remote machine allows administrators to collect logs, store command outputs, and retain this information for future reference or auditing without involving additional steps to copy data back to a local machine.

Explanation:

• \\remote_host: Identifies where to execute the command.
• cmd /c: Tells the system to terminate after running the specified command.
• command: Represents the command you want to execute.
• -an ^>: The redirection operator, prefixed by ^ to escape and ensure it is processed by the remote cmd shell.
• path\to\file.txt: The path where the command output will be stored on the remote system.

Example Output:

The remote execution doesn’t produce output in the local console; instead, the results are saved into the specified file on the remote machine:

Output successfully written to path\to\file.txt

Use case 4: Execute a program to interact with users

Code:

psexec \\remote_host -d -i program_name

Motivation:

This is useful for launching an application that requires user interaction on the remote machine, such as installations or GUI tools visible to users logged onto the console. It allows users on the remote machine to interact with the application during its execution.

Explanation:

• \\remote_host: Targets the remote machine for execution.
• -d: The detach flag, which tells PsExec to run the program without waiting for it to complete.
• -i: Allows the program to interact with the desktop of the target machine, i.e., the interactive user session.
• program_name: The application executable you want to run on the remote machine.

Example Output:

The result of this command is the execution of the specified program on the remote user’s desktop. No direct console output will be visible locally, but the user on the remote machine might see the application window.

Program launched successfully on user desktop at \\remote_host

Use case 5: Display the IP configuration of the remote host

Code:

psexec \\remote_host ipconfig /all

Motivation:

Retrieving the IP configuration of a remote machine helps in diagnosing network issues, verifying connection settings, or gathering information about network interfaces and configurations without accessing the user interface of the remote machine physically.

Explanation:

• \\remote_host: Specifies the target where the command is executed.
• ipconfig: A command-line utility to display all current TCP/IP network configuration values.
• /all: An argument that tells ipconfig to display detailed information about all network adapters.

Example Output:

The command displays comprehensive details of each network interface on the remote machine:

Windows IP Configuration

   Host Name . . . . . . . . . . . . : REMOTE_HOST
   Primary Dns Suffix  . . . . . . . : domain.com
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   ...

Conclusion:

In a world where remote administration is increasingly common, PsExec serves as a valuable tool for IT professionals. From opening remote shells to executing applications and gathering system information, PsExec provides robust capabilities for overseeing and managing networked computers. Understanding and using PsExec responsibly ensures administrators can efficiently and securely handle tasks without unnecessary risks.