Why can't I use PSExec on a Windows domain without disabling the firewall?

I have some Windows 7 machines on the domain with a Windows 2012 DC.

Is it normal that I can't connect with PSExec to run a command as a local administrator from one Windows 7 machine to another without disabling the firewall?

What setting should I change to allow PSExec to work?

Paul Masters

Posted 2016-09-25T20:46:59.507

Reputation: 31

Answers

Is it normal that I can't connect with psexec to run a command as a local administrator from one Windows 7 machine to another without disabling the firewall?

Yes. A firewall is meant to block connections, and if configured to do so, will block connections from programs you would otherwise want unblocked. Being an administrator doesn't give you any special exemption from firewall rules unless your firewall rules are configured to apply differently to admins versus users, which is possible but not the default configuration.

What setting should I change to allow psexec to work?

On the machine you want to remotely access with PsExec, enable the following Inbound firewall rules in the predefined File and Printer Sharing group:

NB-Datagram-In
NB-Name-In
NB-Session-In

With these rules enabled, users with Administrative permissions on the machine will be able to issue commands remotely via PsExec.

I say Reinstate Monica

Posted 2016-09-25T20:46:59.507

Reputation: 21 477

Thanks, it really is working (though it takes more time than with firewall off, I don't understand why). – mTorres – 2019-11-16T11:21:24.167

Also, if you are like me and found that you need to disable UAC, just don't

– mTorres – 2019-11-16T11:36:47.790

-1

have you seen this https://stackoverflow.com/questions/18791468/psexec-win7-to-win7-access-denied-psexesvc-remains also might be able to add an exception for the app in windows firewall Permanently add a firewall exception on Windows 7

Blue Pepper

Posted 2016-09-25T20:46:59.507

Reputation: 1

That's a different issue. Disabling the firewall works for me but I'm wondering what the correct way to fix the issue is. – Paul Masters – 2016-09-25T22:54:46.457

This is really a comment and not an answer to the original question. You can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post. Please read Why do I need 50 reputation to comment? What can I do instead?

– DavidPostill – 2016-09-26T09:10:31.337