PSexec tool is giving error : communicating with PsExec service on "Hostname": No process is on the other end of the pipe.

ADRookie 0

I am trying to delete a folder which is used for "Sysmon Archive Files", which is not possible to delete without PSexec tool. But while running the PSexec tool, I am getting this error, while running

"psexec -sid cmd"

Error communicating with PsExec service on "Hostname":
No process is on the other end of the pipe.

I have tried,
pskill \Hostname PSEXESVC
sc config RemoteRegistry start= auto

sc start RemoteRegistry

sc stop psexesvc

sc start psexesvc

sc.exe stop PSEXESVC

Remove-Item –path 'C:\Windows\PSEXESVC.exe'

Remove-Item -Path hklm:\SYSTEM\CurrentControlSet\Services\PSEXESVC -Confirm:$false

Can anyone suggest any solution to be able to run PSexec tool or any native alternative?

2 answers

Michael Taylor 55,676 Reputation points

2024-11-26T15:14:53.47+00:00

I don't see where you actually entered the remote server name. The syntax is: psexec \\server <options>. If the user running this command doesn't have permissions to the remote server then you'll also need to pass along the credentials to use. The remote server must have file/print sharing enabled for the communication to go through. I've also heard the default admin$ share must be enabled but haven't tested it.
Please sign in to rate this answer.
MotoX80 34,771 Reputation points

2024-11-26T18:03:47.9566667+00:00

He's trying to access the local machine. This a trick to get a command prompt that is running as the system account.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
MotoX80 34,771 Reputation points

2024-11-26T18:20:21.79+00:00

If you removed the registry key (hklm:\SYSTEM\CurrentControlSet\Services\PSEXESVC) without first deleting the service (sc delete psexesvc) then you will need to reboot in order to get the service control manger back in sync with the registry.

When we last discussed this....

https://learn.microsoft.com/en-us/answers/questions/1495484/how-do-i-limit-the-size-of-sysmon-folder-content

...I had built for you a Powershell script and requested that you set the scheduled task to run as the system account. If psexec can launch a command prompt that runs as the system account and allows you to access that folder, then a powershell script that is also running as the system account should also be able to access those files.

Did you test the script?
Please sign in to rate this answer.
ADRookie 0 Reputation points

2024-11-27T07:28:21.9633333+00:00

In the other post, Azar has answered and suggested a script, to be run as "SYSTEM" from Task schedular, which removes files if it crosses a certain size, I have tried and also used variables of Date instead of size, to delete the files,despite setting it up on TaskSchedular for running everyday, it doesn't delete all the files, it runs everyday in my system, and only deletes 5-10% of the files, which are System owned, rest all files are owned by "TrustedInstaller", those are never getting deleted.
Fo rthe PSexec tool, I have tried them all, I have first deleted the psexesvc then I have remove the registry, checked the service was also gone, then I ran the "psexec -sid cmd" command, I have checked the registry again was built and the service appeared again. But still giving the same error.

MotoX80 34,771 Reputation points

2024-11-27T13:12:07.6733333+00:00

Two points...

Run using the -s switch, not -sid. "D" says to run the program non-interactively, and "I" says to interact with the desktop. If you have RDP'd to the server, then you have not logged on to the console. I would think that that is your problem.

-d Don't wait for process to terminate (non-interactive). -i Run the program so that it interacts with the desktop of the specified session on the remote system. If no session is specified the process runs in the console session.

-sid causes a separate window to launch.

While -s uses the existing cmd window.

Point 2.

Look at the script that I posted. It does a try/catch and if the initial delete fails, it does a takeown on the file and tries again.

If running it with "run as administrator" fails, then use a scheduled task that runs as the system account. Run it and then examine the transcript log file to see what it did.

ADRookie 0 Reputation points

2024-11-28T13:54:57.9633333+00:00

Hi @MotoX80
I have tried them now.

Logged into console and tried with -s and -sid both, getting same error.

Logged in with Default domain admin and local admin, tried both the command, same error.

3.Tried the script with task schedular, which you have given, though I have tried the "Takeown" command before as well, again tested this, I got the sysmon log file saved, but nothing was deleted, the size remained same. (only 1 file got deleted as my previsous script ran already few hours back).

All

Thank You for taking up this as challenge, but I don't see what's wrong with it, while my I am able to delete using PSexec in my Lab environment, but not any of the actual servers.
Let me know if there is any alternative is there.

MotoX80 34,771 Reputation points

2024-11-28T15:02:56.8566667+00:00

I have no idea what psexec is doing on your servers.

Given that psexec would be a one time manual process, I recommend that you focus on the script+task since that would be an automated process that you can define once and then just let it run every week or so.

Please share the contents of the C:\YourFavoriteLogFolder\SysmonPurge.log file. (Wherever you put it.)

Remove the bulk of any redundant lines (if there are any) that just show the same thing over and over.

Start-Transcript -Path C:\YourFavoriteLogFolder\SysmonPurge.log $keep = 7 # keep files that have been created in the last nnn days "Permissions for the Sysmon folder" icacls.exe C:\sysmon $files = Get-ChildItem -Path C:\sysmon -file "Starting file count is {0}" -f $files.count foreach ($f in $files) { if ($f.LastWriteTime -lt ((Get-Date).AddDays(-$keep))) { # or use CreationTime "{0} - {1}" -f $f.LastWriteTime, $F.fullname # or use CreationTime try { $f | remove-item -force -ErrorAction stop -whatif } catch { "Take ownership and try again." takeown.exe /f $f.fullname $f | remove-item -force -whatif } } else { "Keeping {0}" -f $f.fullname } } $files = Get-ChildItem -Path C:\sysmon -file "Ending file count is {0}" -f $files.count Stop-Transcript

As I commented in the prior question, the -whatif switch will block the delete from actually occurring. The intent is to not delete any files until you determine if you want to use the LastWriteTime or CreationTime as the criteria for deleting the file.

ADRookie 0 Reputation points

2024-12-05T12:35:29.9466667+00:00

Hi @MotoX80

I have tried this script too by removing the -whatif switch.

The folder size reduced only few MBs which is the usual with my early script.

I am pasting the output for a sample failed deletion file below.

Windows PowerShell transcript start

Start time: 20241205160005

Username: TEST\SYSTEM

RunAs User: TEST\SYSTEM

Configuration Name:

Machine: <Hostname> (Microsoft Windows NT 10.0.17763.0)

Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\TEMP\LimitSysmon.ps1

Process ID: 14472

PSVersion: 5.1.17763.6530

PSEdition: Desktop

PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17763.6530

BuildVersion: 10.0.17763.6530

CLRVersion: 4.0.30319.42000

WSManStackVersion: 3.0

PSRemotingProtocolVersion: 2.3

SerializationVersion: 1.1.0.1

Transcript started, output file is C:\YourFavoriteLogFolder\SysmonPurge.log

Permissions for the Sysmon folder

C:\sysmon NT AUTHORITY\SYSTEM:(OI)(CI)(F)

Mandatory Label\System Mandatory Level:(NW,NR,NX)

Successfully processed 1 files; Failed processing 0 files

Starting file count is 10399

remove-item : Cannot remove item C:\sysmon\000A72678CB6055092AD5F6AB52E4A909742E991D63395128E71763CD0806D6CE05C3CF5C9D1

33DCD40532149A2AC8173F6332FDA4379B51A7903F3431EA9D2A39D2847700000000000000000000000000000000.js: Access to the path is

denied.

At C:\TEMP\LimitSysmon.ps1:15 char:18

$f | remove-item -force # Remove the file ...

~~~~~~~~~~~~~~~~~~

CategoryInfo : InvalidArgument: (C:\sysmon\000A7...000000000000.js:FileInfo) [Remove-Item], ArgumentExc

eption

FullyQualifiedErrorId : RemoveFileSystemItemArgumentError,Microsoft.PowerShell.Commands.RemoveItemCommand

6/16/2023 4:53:05 PM - C:\sysmon\00106206C3DBF49ADB762335C6D83A65D0F84B89D8FE65601370ADC865432BCBEC215B727A940CA9E11519FF7A4946947A656E8E82FCDFA326AD3CEE5862BFE8ECF73A8046E2A7F308D993E2AB48584E557A028B.001b

TerminatingError(Remove-Item): "The running command stopped because the preference variable "ErrorActionPreference" or common parameter is set to Stop: Cannot remove item C:\sysmon\00106206C3DBF49ADB762335C6D83A65D0F84B89D8FE65601370ADC865432BCBEC215B727A940CA9E11519FF7A4946947A656E8E82FCDFA326AD3CEE5862BFE8ECF73A8046E2A7F308D993E2AB48584E557A028B.001b: Access to the path is denied."

Take ownership and try again.

MotoX80 34,771 Reputation points

2024-12-05T13:35:04.67+00:00

What comes after "Take ownership and try again."? Did it show SUCCESS?

PS C:\temp> takeown /f $f.FullName SUCCESS: The file (or folder): "C:\temp\x" now owned by user "BLACKHOLE\madne".

Here is an update where the retry code now reports on the owner and tries to update the permissions.

Start-Transcript -Path C:\YourFavoriteLogFolder\SysmonPurge.log $keep = 7 # keep files that have been created in the last nnn days "Permissions for the Sysmon folder" icacls.exe C:\sysmon $files = Get-ChildItem -Path C:\sysmon -file "Starting file count is {0}" -f $files.count foreach ($f in $files) { if ($f.LastWriteTime -lt ((Get-Date).AddDays(-$keep))) { # or use CreationTime "{0} - {1}" -f $f.LastWriteTime, $F.fullname # or use CreationTime try { $f | remove-item -force -ErrorAction stop } catch { "Take ownership and try again." # Retry code takeown.exe /f $f.fullname "Owner is now {0}" -f $f.GetAccessControl().owner # Did takeown work? "Granting everyone full control." # Give everyone permission to delete. icacls.exe $f.fullname /grant "everyone:(F)" $f | remove-item -force # and try again } } else { "Keeping {0}" -f $f.fullname } } $files = Get-ChildItem -Path C:\sysmon -file "Ending file count is {0}" -f $files.count Stop-Transcript
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

PSexec tool is giving error : communicating with PsExec service on "Hostname": No process is on the other end of the pipe.

2 answers

Your answer