How to Execute Commands Remotely via PsExec Without Admin Rights: A Technical Workaround


1 views

PsExec fundamentally requires administrative privileges to establish remote execution sessions due to its underlying architecture. The tool operates by:

  1. Uploading PSEXESVC.exe to the ADMIN$ share (which requires admin rights)
  2. Creating and starting a Windows service
  3. Establishing named pipe communication

While traditional PsExec won't work, consider these technical alternatives:

1. Scheduled Tasks Method

Create a scheduled task remotely using schtasks.exe:

schtasks /Create /S remotePC /U username /P password /TN "MyTask" /TR "C:\\path\\program.exe" /SC ONCE /ST 00:00
schtasks /Run /S remotePC /U username /P password /TN "MyTask"

2. WMI Execution

Use Windows Management Instrumentation with limited credentials:

wmic /node:remotePC /user:username /password:password process call create "cmd.exe /c your_command"

3. PowerShell Remoting

If WinRM is configured (not enabled by default):

$cred = Get-Credential
Invoke-Command -ComputerName remotePC -Credential $cred -ScriptBlock { your_command }
  • All methods require at least some permissions (often "Remote Management Users" group membership)
  • Windows Defender may block certain techniques in recent Windows versions
  • Network policies must allow the required protocols (DCOM, WMI, WinRM, etc.)

Remember that bypassing standard security controls may violate:

  • Corporate IT policies
  • System hardening guidelines
  • Security compliance requirements

Always obtain proper authorization before implementing alternative remote execution methods.

PsExec from Sysinternals requires administrative privileges by default because it needs to:

  • Create and start a service on the remote machine (PSEXESVC)
  • Write to the ADMIN$ share
  • Interact with the Service Control Manager

While PsExec can't bypass security, these methods allow remote execution with standard user credentials:

1. Using Windows Scheduled Tasks

Create a scheduled task remotely using schtasks.exe:

schtasks /Create /S RemotePC /U Domain\User /P password /TN "MyTask" 
/TR "C:\path\to\program.exe" /SC ONCE /ST 00:00
schtasks /Run /S RemotePC /U Domain\User /P password /TN "MyTask"

2. PowerShell Remoting Alternative

If PowerShell remoting is enabled (requires configuration by admin):

$cred = Get-Credential
Invoke-Command -ComputerName RemotePC -Credential $cred -ScriptBlock {
    Start-Process "C:\path\to\program.exe"
}

3. WMI Method

Using Windows Management Instrumentation with standard user permissions:

$process = [WMICLASS]"\\RemotePC\root\cimv2:Win32_Process"
$process.Create("notepad.exe")

Remember these important points when executing commands remotely:

  • Standard users can only start processes within their permission scope
  • Many organizations log remote execution attempts
  • Some methods may require specific firewall ports to be open

The service-based architecture of PsExec means it needs:

  • Service installation rights (SC_MANAGER_CREATE_SERVICE)
  • Write access to ADMIN$ share (C:\Windows)
  • Ability to create named pipes for communication

If you just need to copy files, consider this PowerShell approach:

$source = "C:\local\file.txt"
$dest = "\\RemotePC\C$\Users\TargetUser\file.txt"
Copy-Item -Path $source -Destination $dest -Credential (Get-Credential)