2

I am writing a program that takes a list of servers and enables/disables RDP. Currently I am utilizing psexec and up in till this morning, everything worked. I made no change in code/usernames/passwords and today I am getting the following error from psexec:

c:\Temp>PsExec.exe \\KEN-SQL-001 -u administrator -p password cmd

PsExec v2.11 - Execute processes remotely
Copyright (C) 2001-2014 Mark Russinovich
Sysinternals - www.sysinternals.com

Could not start PSEXESVC service on KEN-SQL-001:
Access is denied.

I have done a ton of things using winrm before but am having the hardest time finding information involving RDP. Is it possible to enable/disable RDP using WinRM?

nGX
  • 344
  • 1
  • 6
  • 19
  • Try it without psexec: `reg add "\\SERVERNAME\HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f` – Greg Askew Nov 02 '14 at 14:47
  • Has the administrator password simply expired? If so, you would still be allowed to remotely log on interactively (so you can change the password) but not programmatically. – Pak Jun 11 '17 at 21:49

2 Answers2

1

It's a registry setting. I personally think a GPO is the best way to set this behavior, but if you want to do it manually from a command line, use the below:

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
HopelessN00b
  • 53,385
  • 32
  • 133
  • 208
  • Correct, that is the cmd I am using with psexec and it worked perfectly fine till this morning. Is there a way to modify registery remotely using a different method? Preferabbly in a mixed domain environment – nGX Oct 31 '14 at 21:33
  • @KPS Sure, open regedit and use it to connect to another computer (assuming remote registry is enabled), issue the command via winRM or PowerShell remoting or GPO... probably other ways. [Maybe this Q&A is relevant](http://serverfault.com/q/429426/118258), but either way, you need to be able to connect before you can issue a command, so you need to figure out how (or if) you can connect to these computers remotely. – HopelessN00b Oct 31 '14 at 21:37
  • `it worked perfectly fine till this morning.` - Then figure out what changed, and fix that? – Zoredache Oct 31 '14 at 22:20
1

You can RDP through GPO: Windows Components/Remote Desktop Services/Remote Desktop Session Host/Connections
Allow users to connect remotely using Remote Desktop Services = Enabled

If you still prefer WinRM, here's a Posh script to enable RDP through WinRM.

As for the PSExec error, try running something else (even 'notepad.exe') and see if you get the same error.
If you do, that would suggest you either have a permissions problem or some communications error (maybe the $admin share doesn't exist or something like that).

EliadTech
  • 1,230
  • 9
  • 14