Errors starting PsExec to run a program as a local service

Question

When I run the following command from an Administrative Command Prompt:

psexec64 -i -u "nt authority\network service" C:\Windows\System32\cmd.exe

I'm getting these error messages:

Couldn't install PSEXESVC service:
The operation completed successfully.
Error establishing communication with PsExec service on MYPC:
The operation completed successfully.

I'm running this on Windows 7 x64 SP1. The PSEXESVC service is installed and running. I get the same results when using the 32-bit version of psexec.

Any ideas how to fix this problem?

Answer 1

As a workaround, try omitting the -i (interactive) switch, making the new syntax:

psexec64 -u "nt authority\network service" C:\Windows\System32\cmd.exe

According to PSExec's help for this switch:

Run the program so that it interacts with the desktop of the specified session on the remote system. If no session is specified the process runs in the console session.

With the -i switch you would normally get the new Command Prompt in a separate window. Without it, a separate window won't appear, but you'll still get connected to the new CMD.EXE process running in the context of the NT Authority\Network Service user account. You can verify this by running WHOAMI at the prompt.

Answer 2

First I would try to run a local elevation with:

Does that work for you?

"c:\your_path\psexec.exe" -i -s cmd.exe OR "c:\your_path\psexec64.exe" -i -s cmd.exe

You should get something like:

C:\Windows\system32>whoami /user

USER INFORMATION
----------------

User Name           SID
=================== ========
nt authority\system S-1-5-XX

I have tried it on my computer which is in domain:

C:\app\tools\Sysinternals Suite>psexec -i -u "nt authority\network service" C:\Windows\System32\cmd.exe

PsExec v2.2 - Execute processes remotely
Copyright (C) 2001-2016 Mark Russinovich
Sysinternals - www.sysinternals.com

Couldn't install PSEXESVC service:
The network name cannot be found.

Make sure that the admin$ share is enabled.

C:\Windows\System32\cmd.exe exited on XXXX with error code -1073741510.

Producing:

Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>whoami /user

USER INFORMATION
----------------

User Name                    SID
============================ ========
nt authority\network service S-1-5-XX

My guess based on this is that the message Couldn't install PSEXESVC service: is connected to your network name.

Does it work for you if you try it this way?

"\\computer.domain.com\C:\app\tools\Sysinternals Suite\psexec.exe" \\computer.domain.com -u "domain\username" -p "passwd" -e -s cmd.exe

Answer 3

On my up-to-date 64bits French W10 , what works is networkservice without space :

psexec -i -u "nt authority\networkservice" cmd.exe

I hope i may help some of you.