FAQ FAQ  Forum Search   Register Register  Login Login

Remote Execution in PowerShell

 Post Reply Post Reply
Author
  Topic Search Topic Search  Topic Options Topic Options
mikem View Drop Down
I'm new here
I'm new here


Joined: 29 Oct 2008
Online Status: Offline
Posts: 12
  Quote mikem Quote  Post ReplyReply bullet Topic: Remote Execution in PowerShell
    Posted: 29 Oct 2008 at 09:30
Hello All:
 
I need to write a script that will run a remote process that will execute a program on a server.  For example, I need to be able to create a process on a remote machine that runs a program on a mapped drive or UNC share.  Using the Create method from the Win32_process class, I am able to execute any programs on the local disk of the remote machine (ie., notepad, calc) but cannot execute anything on a network resource (I keep getting a return value of 2: Access Denied - I'm a domain admin so I have access to every share).  I checked MSDN and it doesn't really indicate that you can or cannot run something from a network resource. 
 
This is not so much a powershell questions as it is a WMI question, because I can't do this in VBScript either (nor can I do it using psexec). 
 
Any insights would be greately appreciated - thanks!
Back to Top
jvierra View Drop Down
MVP
MVP


Joined: 31 Aug 2006
Location: United States
Online Status: Offline
Posts: 6517
  Quote jvierra Quote  Post ReplyReply bullet Posted: 29 Oct 2008 at 09:54
Yes mikem this is a limitation of WIndows.  What you are trying to do is to ask teh remote machine to be a delegate for you and teh process.  This is blocked by default.  Any process you can access or create on a remote machine will not be able to "touch" any other machine in the network.  Only an "interactive" session can do this by default. 
 
You would need to tell Active Directory to "Trust" the machine for "Delegation" to make this work.  This is usually not a good idea as it can present a considerable security risk if not managed closely.
 
If you really think there is no other way to do this task then "Trust" the machine for delegation and it will allow you to have a remote process access remote resources.  Domain Admins already have delegation authority but non-admin accounts would not be able to do this.
 
Back to Top
jvierra View Drop Down
MVP
MVP


Joined: 31 Aug 2006
Location: United States
Online Status: Offline
Posts: 6517
  Quote jvierra Quote  Post ReplyReply bullet Posted: 29 Oct 2008 at 09:57
Note about PowerShell V2.
 
PowerShell V2, when released, should make all of this remoting much easier and more secure.  YOu migh twant to download the beta and start testing it in it's current state although it is still pretty rough with the remoting mostly due to lack of documentation.
Back to Top
mikem View Drop Down
I'm new here
I'm new here


Joined: 29 Oct 2008
Online Status: Offline
Posts: 12
  Quote mikem Quote  Post ReplyReply bullet Posted: 29 Oct 2008 at 10:17
Thanks for the quick jvierra.
 
I wouldn't want to trust the machine for the security reasons you mentioned.  I installed PS V2 and tried the same script without any luck; I get the same Access Denied errors.  I'll see if I can copy the files locallly and execute them from there.  Our issue is that we're using a very old config management program (WinInstall) to deploy software.  On a number of machines, the WinInstall Service is broken and needs to be reinstalled, so they only way we can do something like this is to either manually install the agent on the machines, or execute some remote process which would be preferable. 
 
I read some posts elsewhere that suggest calling a remote resource works intermittently (whatever that means).  But one post suggested porting the script over to C#, and somehow associate credentials to teh process token - perhaps a project for the future.  
 
Thanks again for your feedback.
 
Back to Top
jvierra View Drop Down
MVP
MVP


Joined: 31 Aug 2006
Location: United States
Online Status: Offline
Posts: 6517
  Quote jvierra Quote  Post ReplyReply bullet Posted: 29 Oct 2008 at 11:23
PowerShellV2 remoting has to be installed on both ends.  You  need the remoting NET classes which are new.  I don't suggest using it in a production environment.  I posted that in case you wanted to play with teh newer features in a test system.
 
To do this kind of a remote install I usually copy all of the file to the target machine then execute the remote "Win32_Process.Create". This will only work if the installer can run in"quiet" or "unattended mode".  This has been a very reliable method of doing remote installs.
 
You can also use Group Policy to do this.
 
 
By the way - I have heard most of those stories and they are out of place.  Your issue is purely delegation.  You either have it or you don't.  There is NO work around.
 


Edited by jvierra - 29 Oct 2008 at 11:27
Back to Top
 Post Reply Post Reply

Forum Jump Forum Permissions View Drop Down