PSEXEC - "The Handle is invalid" When running the command as System User

Question

This is the command that works fine if run from a user-spawned command prompt:

PSEXEC \\xxx.xxx.xxx.xxx -u xxxx -p xxxx -accepteula cmd /c "TYPE C:\Pyxislog\PYXIS01.log|Find/i "%ID%"" >nul

However, if I try to run this from a system-invoked cmd prompt I get this:

Couldn't access 10.219.149.65:
The handle is invalid.
Connecting to 10.219.149.65...

It has to run as a system user, since it will be deployed via a remote software tool which runs as a system user. Is this a limitation of psexec? and yes, the Username and password have administrative rights.

score 12 · Accepted Answer · answered Apr 18 '13 at 12:09

After much research, it is a windows security feature to block all network access to the system user, which includes running tasks as another user. The best method I have found to circumvent this , is to create a scheduled task to run psexec from an administrator account.

score 2 · Answer 2 · edited Mar 20 '17 at 10:18

2

Psexec forces to use System user account by adding -s parameter.

We use psexec to launch some task in remote computers and it logs in a database table. When we dont use -s parameter user appears as domain\administrator but if you use -s parameter it appears as "System"

For the invalid handle message check this:

https://superuser.com/questions/200938/psexec-the-handle-is-invalid

edited Mar 20 '17 at 10:18

Community

1
1

answered Dec 01 '12 at 20:01

Carlos Landeras

11,025
11
56
82

Thanks for your input, however you may misunderstand what I mean. The line works fine if i run my full batch file, because i'm running the batch file as the user account. However, if i try to deploy the package to the same machine that it worked on running manually, it fails because the deployment run's the batch file as a SYSTEM user. I don't need PSEXEC to access the system account on the remote machine, I need it to access an admin account. – bill Dec 02 '12 at 00:54
Are you using the same user account in the psexec login? I guess you are – Carlos Landeras Dec 02 '12 at 01:27
Yes, for example I copy paste the command that I showed above for PSEXEC (with the xxxx's filled in) into a CMD window that I opened by going to start > run > CMD. Then I invoke another CMD window as the SYSTEM user by doing `psexec -i -s cmd.exe` and then paste the exact same command I did in the first CMD window, and it will re-create this error. – bill Dec 02 '12 at 11:42

score 1 · Answer 3 · answered Dec 29 '15 at 06:07

1

Have you tried using the -h flag?

from technet: -h If the target system is Vista or higher, has the process run with the account's elevated token, if available.

Full page: https://technet.microsoft.com/en-us/sysinternals/psexec.aspx

answered Dec 29 '15 at 06:07

The IT guy

11
1

This process is being run under the NT Authority\SYSTEM account, not as a user. so it has no elevation token to use. – bill Jan 12 '16 at 17:24

score 0 · Answer 4 · answered Oct 25 '17 at 19:28

0

It might be unrelated, but I actually found I got this "The handle is invalid" error if the connection went down to the machine - i.e. the machine fell asleep.

answered Oct 25 '17 at 19:28

vapcguy

7,097
1
56
52

score 0 · Answer 5 · answered Jul 09 '19 at 18:56

Here is the code I used to follow The IT guy's instructions on scheduling a task to run as admin and avoid the "The handle is invalid" issue.

        //Schedule a task that will run the script
        using (TaskService ts = new TaskService())
        {
            TaskDefinition td = ts.NewTask();
            td.RegistrationInfo.Description = "Runs script as admin user";
            td.Triggers.Add(new TimeTrigger(DateTime.Now.AddMinutes(2)));
            td.Actions.Add(new ExecAction(@"C:\...\script.exe"));
            try
            {
                ts.RootFolder.RegisterTaskDefinition(@"Script", td, TaskCreation.CreateOrUpdate, "username", "password", logonType: TaskLogonType.Password);
            }
            catch (UnauthorizedAccessException e)
            {
                Console.WriteLine("Could not register task in task scheduler.");
                Console.WriteLine(e.ToString());
                return;
            }
        }

score 0 · Answer 6 · answered Oct 30 '19 at 09:22

My code works perfectly :

public static void RunTask(string[] task, string username, string password)
{
    System.Diagnostics.ProcessStartInfo psi = new System.Diagnostics.ProcessStartInfo(task[1] + ".exe");
    psi.RedirectStandardOutput = true;
    psi.RedirectStandardError = true;
    psi.CreateNoWindow = true;
    psi.UseShellExecute = false;
    string args = String.Format(@"-u {1} -p {2} -accepteula \\{0} " + (task[1] == "psexec" ? "-d -s -i 2 {3}" : "{3}"), task[0], username, password, task[1] == "psservice" ? task[2].TrimStart('"').Insert(task[2].IndexOf(' '), "\"") : task[2]);
    psi.Arguments = args;

    System.Diagnostics.Process prc = System.Diagnostics.Process.Start(psi);
    string output = (prc.StandardError.ReadToEnd() + "\r\n" + prc.StandardOutput.ReadToEnd()).Trim();
    output = output.Substring(output.IndexOf(".com\r\n\r\n") + 8);

    prc.WaitForExit();

    if (!(output.Contains("started on") || output.Contains("killed on") || output.Contains("SERVICE_NAME"))) throw new Exception(output);
}

Sample calls :

    RunTask(new string[] { "MACHINE", "psexec", @"""C:\Program Files (x86)\Internet Explorer\iexplore.exe""" }, "USERNAME", "PASSWORD");
    RunTask(new string[] { "MACHINE", "pskill", @"""iexplore.exe""" }, "USERNAME", "PASSWORD");
    RunTask(new string[] { "MACHINE", "psservice", @"""start SOMESERVICE""" }, "USERNAME", "PASSWORD");
    RunTask(new string[] { "MACHINE", "psservice", @"""stop SOMESERVICE""" }, "USERNAME", "PASSWORD");

Make sure you have the psexec.exe, pskill.exe and psservice.exe beside your program.

PSEXEC - "The Handle is invalid" When running the command as System User

6 Answers6

Linked