PsExec

Sysinternals PsExec.exe creates a process locally or remotely. In the report it is used after an administrator context has already been obtained. -s requests SYSTEM execution; it does not give an ordinary user permission to create the service needed for that process.

Check the existing identity

From an elevated lab command prompt:

whoami /all
PsExec.exe -?
PsExec.exe -accepteula -s whoami.exe

The final command is a short identity proof. Successful SYSTEM output establishes the launched process’s token, not that a separate vulnerability was exploited by PsExec.

Remote administration example

PsExec.exe \\host.example.test -u EXAMPLE\labadmin whoami.exe

Omitting -p requests a password prompt. Remote use requires the relevant administrative access and reachable Windows services. File sharing, firewall rules and remote token filtering affect the result.

Success: the target process runs under the intended identity. -i selects an interactive desktop session and is unnecessary for this short proof. Review service and process artefacts after testing. Impacket’s Python psexec.py is another implementation with different authentication options and argument syntax; see Impacket rather than combining flags from the two programs.

Choose the process context

Option	Meaning	Common misunderstanding
`-s`	Launch as LocalSystem	Still needs permission to create/control the service
`-u DOMAIN\user`	Select an account	Omitting `-p` gives a password prompt
`-h`	Use the account’s elevated token if available	Does not give elevation to an account without it
`-i [session]`	Attach to an interactive desktop session	Unnecessary for command-output checks
`-d`	Do not wait for the process to finish	Loses the ordinary synchronous completion check
`-c`	Copy the specified executable	A remote file transfer and service execution are involved
`-w path`	Set target working directory	Does not change the source machine’s directory

Local proof versus remote proof

rem Local machine, from an already elevated prompt
PsExec.exe -accepteula -s whoami.exe /all

rem Named remote machine, with a prompted password
PsExec.exe \\host.example.test -u EXAMPLE\labadmin whoami.exe /all

Record both the target hostname and returned identity. LocalSystem is local to the target; its network authentication commonly uses the machine account. A SYSTEM process is not automatically a domain administrator.

Test the transport before changing execution options

Test-NetConnection host.example.test -Port 445
Get-Service -Name LanmanServer

The service query above is local. On the remote host, separately verify SMB/service-control availability and administrative share access. Successful TCP/445 connection proves only a listener exists. UAC remote filtering can affect local administrator accounts even when their password is correct.

Errors and exit codes

Observation	Investigate
Access denied before process launch	Remote admin rights, share ACLs, token filtering and service control
Path not found	Target executable path; use `-c` only when copying is intended
Service fails to start	Security policy, binary compatibility and target event logs
Command exits with a nonzero code	The launched program’s own failure, not necessarily transport failure
No desktop window appears	Session isolation; prefer captured command output

For a program that returns a Win32 error, preserve the numeric code and command context. Do not treat every nonzero exit as a PsExec authentication failure.

Remote execution normally uses a temporary service and helper binary. Confirm their removal after a normal exit; investigate remnants after interruption without deleting unrelated services. Retain target process identity and command output as the proof. Sysinternals flags belong to this executable; hash authentication, -k and -no-pass belong to the separate Impacket implementation.

How attacks work. Examples use fictional lab values; replace placeholders only with values from the system you are testing.