community.spiceworks.com
Open in
urlscan Pro
45.60.13.212
Public Scan
URL:
https://community.spiceworks.com/topic/2036887-psexec-the-system-cannot-find-the-file-specified
Submission: On June 08 via manual from US — Scanned from DE
Submission: On June 08 via manual from US — Scanned from DE
Form analysis 1 forms found in the DOM
<form>
<i class="1686231839750 mag-glass"></i>
<input class="1686231839750 search-input" autocomplete="off" placeholder="Search Spiceworks">
<i class="clean-icon"></i>
<div class="1686231839750 trending-topics"></div>
<div class="1686231839750 search-box-results"></div>
</form>Text Content
Home
* News & Insights
* News & Insights Home
* Innovation
* IT Careers & Skills
* Cloud
* Cyber Security
* Future of Work
* All Categories
* Marketing
* HR
* Finance
* Community
* Ask question
* Community Home
* Spiceworks Originals
* Cloud
* Collaboration
* Networking
* Water Cooler
* Windows
* All forums
* How-Tos
* Scripts
* Vendors
* Meetups
* Reviews
* Online Events
Login Join
Login Join
* Home
* Windows
* Windows Server
PSEXEC "THE SYSTEM CANNOT FIND THE FILE SPECIFIED."
Posted by jamesfreeling on Aug 23rd, 2017 at 5:36 PM
Windows Server
So, I have a server called myDOMAIN\SERVERNAME. On that server, in a directory
called "WORKING_FOLDER," I have copied psexec, a list of my workstations, and a
batch file that I want to run on each workstation in the list.
Again, I want each workstation to run the batch file remotely, from
"\\SERVERNAME\WORKING_FOLDER\<batchfile.bat>"
Therefore, from the server, I open a CMD window as Administrator, then cd\ into
C:\WORKING_FOLDER.
Then I execute the following command:
psexec -accepteula @"c:\WORKING_FOLDER\workstations.csv" -u
mydomain\ADMINusername -p ADMINPASSWORD -h
"\\SERVERNAME\WORKING_FOLDER\batchfile.bat"
When I press ENTER, I see the first workstation in the list come up. We will
call it "WORKSTATION1."
This is followed by the following error:
"PsExec could not start \\SERVERNAME\WORKING_FOLDER\batchfile.bat on
WORKSTATION1:
The system cannot find the file specified."
What am I doing wrong? My credentials have local admin rights on the
workstation.
Thanks in advance to anyone who can help.
Spice (5) Reply (16)
flagReport
jamesfreeling
pimiento
New contributor
ENTER TO WIN A 2 WIN $500, 9 WIN $100
Contest ends Jun 16, 2023 Contests Contest Details View all contests
16 REPLIES
* MatthewSRoach
thai pepper
Aug 23rd, 2017 at 5:52 PM
Are the permissions (Share level and NTFS level) set properly for that user
for WORKING_FOLDER?
If you log in to that computer with the specified user, can you execute the
batch?
flagReport
Was this post helpful? thumb_up thumb_down
* davidr4
This person is a verified professional.
Verify your account to enable IT peers to see that you are a professional.
habanero
Aug 23rd, 2017 at 5:55 PM
Is Working_Folder a share? You actually need to share that folder or use the
admin share (c$)
Spice (2) flagReport
Was this post helpful? thumb_up thumb_down
* cenkpekerkan
This person is a verified professional.
Verify your account to enable IT peers to see that you are a professional.
anaheim
Aug 23rd, 2017 at 5:57 PM
Hello James,
From what I understand, correct me if I am wrong. workstation local admin and
your credentials on the server are different...
It is my humble opinion, the Local admin account on the WS01 lack the rights
to execute (Full control) on the server. Especially so since you are reaching
that path through UNC.
Workstation1 = WS01
Servername = SRV
One way to test it is,
Remove "everyone" permissions on that specific folder
("\\SRV\WorkingFolder)", and you should not be able to read that folder from
WS01
Also note, alongside the share TAB, Security Tab is also involved on setting
UNC permissions such as execute. Try adding the same user under security tab
and giving appropriate permissions but for this the suggestion below is more
secure. In my opinion at least
May I ask why do you not set a user (i.e. agent_ps) domain user.
Than give that user Local Admin rights on the workstations? This will also be
much more secure. instead of adding the same user on the server as local
admin.
* local_offer Tagged Items
* jamesfreeling
flagReport
Was this post helpful? thumb_up thumb_down
* OP jamesfreeling
pimiento
Aug 23rd, 2017 at 6:08 PM
"Are the permissions (Share level and NTFS level) set properly for that user
for WORKING_FOLDER?
If you log in to that computer with the specified user, can you execute the
batch?"
Thanks for your reply. Yes. Share is read write and security is full access
for the user.
I just logged into the server from my workstation, and was able to execute
the batch.
Spice (1) flagReport
Was this post helpful? thumb_up thumb_down
* davidr4
This person is a verified professional.
Verify your account to enable IT peers to see that you are a professional.
habanero
Aug 23rd, 2017 at 6:10 PM
Running the CMD as Admin puts you in a different security context. Try just
running the CMD as normal
Spice (1) flagReport
Was this post helpful? thumb_up thumb_down
* OP jamesfreeling
pimiento
Aug 23rd, 2017 at 6:16 PM
"From what I understand, correct me if I am wrong. workstation local admin
and your credentials on the server are different..."
Yes. But the username and password that I used with PSEXEC are admin creds on
the workstation.
"May I ask why do you not set a user (i.e. agent_ps) domain user.
Than give that user Local Admin rights on the workstations? This will also be
much more secure. instead of adding the same user on the server as local
admin."
I did this, except used a domain admin account. I will do some further tests.
flagReport
Was this post helpful? thumb_up thumb_down
* OP jamesfreeling
pimiento
Aug 23rd, 2017 at 6:18 PM
> davidr4 wrote:
>
> Is Working_Folder a share? You actually need to share that folder or use
> the admin share (c$)
(Ah. Finally saw the "Quote Post" link)
Yes. WORKING_FOLDER is a share.
flagReport
Was this post helpful? thumb_up thumb_down
* MatthewSRoach
thai pepper
Aug 23rd, 2017 at 6:26 PM
Log in to the first workstation in the csv as this user. try to run the
batch from that workstation.
flagReport
Was this post helpful? thumb_up thumb_down
* mikewigle
This person is a verified professional.
Verify your account to enable IT peers to see that you are a professional.
jalapeno
Aug 23rd, 2017 at 6:34 PM
Not to re-invent the wheel but I personally had trouble implementing PSEXEC
the way it should work so I took a different approach. On the Domain
Controller as Domain Administrator I run:
Powershell
$CMD=ipconfig /flushdns
$C=get-adcomputer -filter * -searchbase "ou=CABVI,dc=cincyblind,dc=local"| ForEach-Object {$_.Name}
foreach($obj in $C)
{
Invoke-command -computername $obj -scriptblock {$CMD}
}
Of course, populate $C with your CSV however you prefer and put in your own
$CMD script block but I have found using Invoke-Command to be a nice way to
hit all of my systems fairly quickly. I just adjust the $CMD variable to be
what ever I need to run. YMMV but if you continue to have trouble with PSEXEC
it might be worth a try.
Spice (1) flagReport
Was this post helpful? thumb_up thumb_down
* OP jamesfreeling
pimiento
Aug 23rd, 2017 at 6:36 PM
> cenkpekerkan wrote:
>
> Hello James,
>
> From what I understand, correct me if I am wrong. workstation local admin
> and your credentials on the server are different...
>
> It is my humble opinion, the Local admin account on the WS01 lack the
> rights to execute (Full control) on the server. Especially so since you are
> reaching that path through UNC.
>
> Workstation1 = WS01
>
> Servername = SRV
>
>
> One way to test it is,
>
>
> Remove "everyone" permissions on that specific folder
> ("\\SRV\WorkingFolder)", and you should not be able to read that folder
> from WS01
>
> Also note, alongside the share TAB, Security Tab is also involved on
> setting UNC permissions such as execute. Try adding the same user under
> security tab and giving appropriate permissions but for this the suggestion
> below is more secure. In my opinion at least
>
>
> May I ask why do you not set a user (i.e. agent_ps) domain user.
> Than give that user Local Admin rights on the workstations? This will also
> be much more secure. instead of adding the same user on the server as local
> admin.
SO. I did remove the "Everyone" permission, and it is exactly as you say. I
could not access the WORKING_FOLDER from WS01. Isn't it enough that I added
the account used for PSEXEC (which has rights to the server) into the local
Administrators group for WS01?
flagReport
Was this post helpful? thumb_up thumb_down
*
* OP jamesfreeling
pimiento
Aug 23rd, 2017 at 6:41 PM
> mikewigle wrote:
>
> Not to re-invent the wheel but I personally had trouble implementing PSEXEC
> the way it should work so I took a different approach. On the Domain
> Controller as Domain Administrator I run:
>
> Powershell
>
> $CMD=ipconfig /flushdns
> $C=get-adcomputer -filter * -searchbase "ou=CABVI,dc=cincyblind,dc=local"| ForEach-Object {$_.Name}
> foreach($obj in $C)
> {
> Invoke-command -computername $obj -scriptblock {$CMD}
> }
>
>
>
> Of course, populate $C with your CSV however you prefer and put in your own
> $CMD script block but I have found using Invoke-Command to be a nice way to
> hit all of my systems fairly quickly. I just adjust the $CMD variable to be
> what ever I need to run. YMMV but if you continue to have trouble with
> PSEXEC it might be worth a try.
Thanks much!
This sounds quite promising. If I can't get PSEXEC to work, then I will try
this. I am now very curious as to why PSEXEC does not work.
flagReport
Was this post helpful? thumb_up thumb_down
* davidr4
This person is a verified professional.
Verify your account to enable IT peers to see that you are a professional.
habanero
Aug 23rd, 2017 at 6:41 PM
It depends what your permissions are on the folder and share
Spice (2) flagReport
Was this post helpful? thumb_up thumb_down
* cenkpekerkan
This person is a verified professional.
Verify your account to enable IT peers to see that you are a professional.
anaheim
Aug 25th, 2017 at 8:20 AM
Sorry I have missed your reply...
You are executing that file or script on the server. So although you are
accessing it from WS01, the Sever has the authority on who can do what with
who.
Have you tried my suggestion of:
May I ask why do you not set a user (i.e. agent_ps) domain user.
Than give that user Local Admin rights on the workstations? This will also be
much more secure. instead of adding the same user on the server as local
admin.
Also please make sure the said agent_ps user has full control on both sharing
and the security tab for the Working Folder on the "Server"
PM me if you run into issues.
flagReport
Was this post helpful? thumb_up thumb_down
* OP jamesfreeling
pimiento
Aug 25th, 2017 at 11:12 AM
> cenkpekerkan wrote:
>
> Sorry I have missed your reply...
>
> You are executing that file or script on the server. So although you are
> accessing it from WS01, the Sever has the authority on who can do what with
> who.
>
> Have you tried my suggestion of:
>
> May I ask why do you not set a user (i.e. agent_ps) domain user.
> Than give that user Local Admin rights on the workstations? This will also
> be much more secure. instead of adding the same user on the server as local
> admin.
> Also please make sure the said agent_ps user has full control on both
> sharing and the security tab for the Working Folder on the "Server"
>
> PM me if you run into issues.
Thanks so much. I will work on this now.
flagReport
Was this post helpful? thumb_up thumb_down
* OP jamesfreeling
pimiento
Aug 25th, 2017 at 5:08 PM
> cenkpekerkan wrote:
>
> Sorry I have missed your reply...
>
> You are executing that file or script on the server. So although you are
> accessing it from WS01, the Sever has the authority on who can do what with
> who.
>
> Have you tried my suggestion of:
>
> May I ask why do you not set a user (i.e. agent_ps) domain user.
> Than give that user Local Admin rights on the workstations? This will also
> be much more secure. instead of adding the same user on the server as local
> admin.
> Also please make sure the said agent_ps user has full control on both
> sharing and the security tab for the Working Folder on the "Server"
>
> PM me if you run into issues.
(I am unable to PM, since I am a new user. So I am posting here.)
I set up the agent_ps user in a GPO so that it becomes a local admin on all
workstations. And it works fine.
I can successfully execute the following on my server:
psexec -accepteula @"\\SERVERNAME\WORKING_FOLDER\list.csv" -u
MYDOMAIN\agent_ps -p "agent_ps Password" ipconfig.exe
The ipconfig for the workstation displays on the server just fine.
HOWEVER...
I cannot seem to get the following to work.
psexec @"\\SERVERNAME\WORKING_FOLDER\list.csv" -u MYDOMAIN\agent_ps -p
"agent_ps password" -h "\\SERVERNAME\WORKING_FOLDER\batchfile.bat"
When I look at "agent_ps" rights on \\SERVERNAME\WORKING_FOLDER, they are
FULL. In fact, I can login as "agent_ps" on WORKSTATION1 and access
everything in \\SERVERNAME\WORKING_FOLDER without restriction.
"agent_ps" also has local admin rights on WORKSTATION1. BUT, I get this
error: "Couldn't install PSEXESVC service: Access is denied." if I execute
the following on the workstation:
\\SERVERNAME\WORKING_FOLDER\psexec @"\\SERVERNAME\WORKING_FOLDER\list.csv" -u
MYDOMAIN\agent_ps -p "agent_ps password" -h
"\\SERVERNAME\WORKING_FOLDER\batchfile.bat",
And, if I elevate the prompt, I get this:
"PsExec could not start \\SERVERNAME\WORKING_FOLDER\batchfile.bat on
WORKSTATION1: Access is denied."
Stumped. Don't see where I am going wrong.
flagReport
Was this post helpful? thumb_up thumb_down
* mikewigle
This person is a verified professional.
Verify your account to enable IT peers to see that you are a professional.
jalapeno
Aug 29th, 2017 at 12:49 PM
You may need to add that user to the following GPO(s):
Computer Configuration->Policies->Windows Settings->Security Settings->Local
Policies/User Rights Assignment->Log on as a service
and/or
Computer Configuration->Policies->Windows Settings->Security Settings->Local
Policies/User Rights Assignment->Log on as a batch job
The error appears, to me, to be stating that the command is trying to run
either as a batch job or service (or maybe both, I'm a little fuzzy in this
area) and that's why it's being blocked. I have a user account I created
specifically for running batch jobs and scheduled tasks and found I had to
add the account to both of those GPO areas.
(Sorry for the delay, I've been on vacation)
flagReport
Was this post helpful? thumb_up thumb_down
lock
This topic has been locked by an administrator and is no longer open for
commenting.
To continue this discussion, please ask a new question.
READ THESE NEXT...
* INTRUSION DETECTION IN A HOME OFFICE ENVIRONMENT
Security
What do you all recommend for Intrusion Detection for small businesses that
work out of their home? Customer sent me an email asking for the following.
He is an accountant and deals with his customers financial data and wants to
be protected.I need to mo...
*
* WHAT IS THE CORRECT PROCEDURE TO CLONE A PC?
Software
Good Day Folks, I am new to the IT world and need to learn heaps from the
experts. Now I wanted to ask what experts do to image an existing pc so that
the image can be used for the new pc. The pc I am trying to image is a
domain-joined pc. Do I have to re...
* BRAND REP WRAP-UP: MAY 2023
Spiceworks Originals
Hi, y'all - Chad here. Last month was bonkers - lots of posts, lots of
engagement, lots of helpful answers. We've talked a lot this year about
"bringing the Spice back" to our Community, and I feel like we're starting to
cook. Great job, everybody! Your p...
* SNAP! -- GHOSTBOTS VS POST-MORTEM PRIVACY, GRIMACE SHAKE, INTELLIGENT ROBOT
DOGS
Spiceworks Originals
Your daily dose of tech news, in brief. Welcome to the Snap! Flashback: June
7, 1955: Dwight D. Eisenhower becomes the first US President to appear on
color TV (Read more HERE.) Bonus Flashback: June 7, 1965: Gemini 4 completes
62 orbits...
* WHY MILLIONS OF USABLE HARD DRIVES ARE BEING DESTROYED
Hardware
Why millions of usable hard drives are being destroyed Opens a new windowI
thought after 5 years in a datacentre there would be a high chance of
failure?
* About
* Contact
* Support
* Press / Media
* Careers
* SpiceWorld
* Blog
* *
*
*
*
* Sitemap
* Privacy Policy
* Terms of Use
* Guidelines
* Accessibility Statement
* Do Not Sell My Personal Information
* © Copyright 2006 - 2023 Spiceworks Inc.
WE CARE ABOUT YOUR PRIVACY
If you consent, we and our partners can store and access personal information on
your device to provide a more personalised browsing experience. This is
accomplished through processing personal data collected from browsing data
stored in cookies. You can provide/withdraw consent and object to processing
based on a legitimate interest at any time by clicking on the ‘Manage
Preferences’ button.Our Privacy Policy
WE AND OUR PARTNERS PROCESS DATA TO:
Store and/or access information on a device. Personalised ads and content, ad
and content measurement, audience insights and product development. Our Partners
Reject All I Accept
More Options