Windows sysinternals

Chapter 6 Pstools 179
starts an instance of Cmd.exe on server1 that runs the built-in ver command and then exits.
The output of ver from server1 appears in the local console window in which PsExec was
launched. In this case, Cmd.exe is the “program” part of the PsExec command line and /c ver
is the optional “arguments” part passed to the program when it starts.
PsExec Alternate Credentials
The “Alternate Credentials” section earlier in this chapter described the use of the –u and –p
parameters to provide explicit credentials to PsTools utilities. If these options are not used,
the logged-on user account that is running PsExec is used to authenticate to the remote
system, and then that account is impersonated by the remote process started by PsExec. This
raises several issues:
■ To start a process on a remote system, PsExec must use an account that has
administrative rights on the remote system.
■ If the remote process accesses network resources, it will authenticate as anonymous
unless Kerberos delegation has been enabled. This is the one-hop limitation of impersonation:
the computer on which a logon session is established with explicit credentials
can authenticate to a remote server that can impersonate that security context on that
system, but the process on the remote computer cannot then use the security context
to authenticate to a third system.
■ The impersonated security context will not include any logon SIDs that would grant it
access to any interactive user sessions.
You should provide explicit credentials if the account running PsExec does not have
administrative access to the remote computer, if the remote process requires authenticated
access to network resources, or if the remote process needs to run on an interactive user
desktop. When explicit credentials are supplied, they are used to authenticate to the remote
system, and then to create a new logon session that can run on a particular interactive
desktop.
Important The user name and password used to create the new logon session are transmitted
to the remote system in the clear—that is, unencrypted. Anyone sniffing the network will be
able to capture these credentials. Consider configuring your network to use IPsec with ESP
(Encapsulating Security Payload) to encrypt all communications.
The –u and –p parameters can also be used when starting a process on the local computer,
in a manner similar to RunAs.exe. And as with RunAs.exe, because of UAC the target process
will not have full administrative rights on Windows Vista or newer, even if the user account is
a member of the Administrators group (unless you specify –h, described later).
www.it-ebooks.info