How to run exe as a service with elevated credentials on remote PC with psexec?

1
votes

I am using the command below (and tried many variations) to run an exe as a different domain user on a remote pc as a service (phew!).

psexec \\RemotePC -u admin -p mypass "SC create MyService displayname= "MyService" binpath= "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\MyService.exe" start= auto obj= corp\service_account password= servicepass"

I get:

PsExec could not start sc create MyService displayname=MyService on RemotePC: The system cannot find the file specified.

I think I'm probably getting some spaces or quotation marks in the wrong place, but this is driving me nuts. Have tried all kinds of variations, including launching cmd.exe and passing the sc command in as an argument. Same issue.

Both Windows 7 PC's in a domain environment. Attempting to send local administrative user credentials with psexec command, and attempting to execute the sc command as a domain-level user.

EDIT:

Tried this:

c:\SysInternals>psexec \\RemotePC -h -u localadmin -p mypass "sc create MyService displayname= \"MyService Name\" binpath= \"C:\ProgramData\Microsoft\Windows\Start Menu \Programs\Startup\MyService.exe\" start= auto obj= corp\service_account password= domainpass"

and got:

PsExec v2.11 - Execute processes remotely Copyright (C) 2001-2014 Mark Russinovich Sysinternals - www.sysinternals.com

Starting sc create MyService displayname= "MyService Name" binpath= "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\MyService.exe" start= auto obj= corp\service_acc

PsExec could not start on RemotePC: The filename, directory name, or volume label syntax is incorrect.

c:\SysInternals>

1
psexec

1 Answers

1
votes

Loving the downvote with no comments or reason...

I solved this myself by simply removing all the quotes for anyone else having this issue.

c:\SysInternals>psexec \\RemotePC -h -u localadmin -p localpass sc create MyService displayname= MyService binpath= C:\Temp\Script\MyService.exe start= auto obj= corp\domainuser passw
ord= domainpass