PsExec
Utilities like Telnet and remote control programs like Symantec's PC Anywhere let you execute programs on remote systems, but they can be a pain to set up and require that you install client software on the remote systems that you wish to access. PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. PsExec's most powerful uses include launching interactive command-prompts on remote systems and remote-enabling tools like IpConfig that otherwise do not have the ability to show information about remote systems.
Installation
Copy PsExec onto your executable path. Typing "psexec" displays its usage syntax.
Usage
usage: [\\computer[,computer[,...] | @file][-u user [-p psswd]][-n s][-l][-s|-e][-i [session]][-c [-f|-v]][-d][-w directory][-<priority>][-a n,n,...>] cmd [arguments]
|
|
computer |
Direct PsExec to run the application on the computer or computers specified. If you omit the computer name PsExec runs the application on the local system and if you enter a computer name of \\* then PsExec executes the commands on all computers in the current domain. |
|
|
@file |
PsExec will execute the command on each of the computers listed in the file. |
|
|
-u |
Specifies optional user name for login to remote computer. |
|
|
-p |
Specifies optional password for user name. If you omit this you will be prompted to enter a hidden password. |
|
|
-s |
Run remote process in the System account. |
|
|
-e |
Loads the specified account's profile. |
|
|
-i |
Run the program so that it interacts with the desktop of the specified session on the remote system. If no session is specified the process runs in the console session. |
|
|
-l |
Run process as limited user (strips the Administrators group and allows only privileges assigned to the Users group). On Windows Vista the process runs with Low Integrity. |
|
|
-c |
Copy the specified program to the remote system for execution. If you omit this option then the application must be in the system's path on the remote system. |
|
|
-n |
Specifies timeout in seconds connecting to remote computers. |
|
|
-f |
Force the copy of the specified program if it already exists on the remote system. |
|
|
-v |
Copy the specified file only if it has a higher version number or is newer on than the one on the remote system. |
|
|
-d |
Don't wait for application to terminate. Only use this option for non-interactive applications. |
|
|
-w |
Set the working directory of the process (relative to the remote computer). |
|
|
-x |
Display the UI on the Winlogon desktop. |
|
|
-priority |
Specifies -low, -belownormal, -abovenormal, -high or -realtime to run the process at a different priority. |
|
|
-a |
Separate processors on which the application can run with commas where 1 is the lowest numbered CPU. For example, to run the application on CPU 2 and CPU 4, enter: "-a 2,4" |
|
|
arguments |
Arguments to pass (note that file paths must be absolute paths on the target system) |
You can enclose applications that have spaces in their name with quotation marks e.g. "psexec \\marklap "c:\long name\app.exe". Put arguments directed at the application outside of the parenthesis. Input is only passed to the remote system when you press the enter key, and typing Ctrl-C terminates the remote process.
If you omit a username the remote process runs in the same account from which you execute PsExec, but because the remote process is impersonating it will not have access to network resources on the remote system. When you specify a username the remote process executes in the account specified, and will have access to any network resources the account has access to. Note that the password is transmitted in clear text to the remote system.
Examples
The following command launches an interactive command prompt on \\marklap:
psexec \\marklap cmd
This command executes IpConfig on the remote system with the /all switch, and displays the resulting output locally:
psexec \\marklap ipconfig /all
This command copies the program test.exe to the remote system and executes it interactively:
psexec \\marklap -c test.exe
Specify the full path to a program that is already installed on a remote system if its not on the system's path:
psexec \\marklap c:\bin\test.exe