How can I remotely pass cmd commands which require admin privileges via psexec to a limited account user?

3

1

C:\PSEXEC \\mechaflash -u admin -p admin cmd.exe /C "REG ADD HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /v WUServer /t REG_SZ /d http://WSUS_Server:8530 /f && REG ADD HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /v WUStatusServer  /t REG_SZ /d http://WSUS_Server:8530 /f && SHUTDOWN -r -t 00"

The command stated that it completed successfully, and the remote machine rebooted. However, the registry changes did not actually take place.

The cmd commands were tested locally and work fine.

Is this a privilege issue?

Mechaflash

Posted 2011-12-05T14:12:31.317

Reputation: 1 226

Where does the limited account user come in? – Harry Johnston – 2011-12-05T22:58:12.307

1Is it possible that group policy is overwriting your settings? – Harry Johnston – 2011-12-05T22:59:26.330

The limited user is logged in on the remote computer. However, I'm using the administrator credentials for the computer, but not getting the desired results – Mechaflash – 2011-12-05T23:40:01.370

OK, it shouldn't make any difference who is logged in on the remote computer. I think you need to look elsewhere, e.g., group policy. – Harry Johnston – 2011-12-06T01:27:09.400

Trying using the -s flag to execute as system? that would definitely bypass any limited-user issues – arcyqwerty – 2011-12-06T06:23:28.103

@HarryJohnston What should I be looking for in my group policy settings? – Mechaflash – 2011-12-06T16:37:13.280

@arcyqwerty I'll try that out. – Mechaflash – 2011-12-06T16:37:25.853

Computer Configuration: Policies: Administrative Templates: Windows Components / Windows Update. – Harry Johnston – 2011-12-07T02:48:24.480

1One thing to try would be removing the reboot and seeing what happens. (Note also that you don't generally have to reboot in order to change Windows Update settings.) – Harry Johnston – 2011-12-07T02:49:52.683

@HarryJohnston you were right about the group policy overwriting the settings. I figured changing the registry would in turn change the group policy (as that was the aim). If you want to put it as an answer, I'll select it as the correct one. – Mechaflash – 2011-12-07T19:06:44.527

Answers

2

It turns out that the command was in fact working as expected, but the registry changes were being overwritten by group policy.

Harry Johnston

Posted 2011-12-05T14:12:31.317

Reputation: 5 054