Jesse's questions

I have a Windows Service running as Local System on Windows Server 2003 and I'm trying to use PsExec to run a command as another user (using the -u -p parameters) but I keep getting Access is denied. PsExec could not start errors.

The following can be performed to replicate the issue:

C:\Documents and Settings\me>PsExec.exe -s cmd

PsExec v2.11 - Execute processes remotely
Copyright (C) 2001-2014 Mark Russinovich
Sysinternals - www.sysinternals.com


Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\WINNT\system32>whoami
nt authority\system

C:\WINNT\system32>PsExec.exe -u DOMAIN\my-user -p mypass cmd

PsExec v2.11 - Execute processes remotely
Copyright (C) 2001-2014 Mark Russinovich
Sysinternals - www.sysinternals.com

Access is denied.
PsExec could not start cmd:

In the example above, the first PsExec command (PsExec.exe -s cmd) will give you a command line as Local System. Then the second PsExec command (PsExec.exe -u DOMAIN\my-user -p mypass cmd) throws the error that I'm trying to resolve.

Any help would be greatly appreciated! Thank you in advance!

I have a Windows Service running as Local System on SERVER_X which is attempting to access a script on a UNC share hosted on SERVER_Y.

Per the links below, I've granted the computer account of SERVER_X access to the UNC on SERVER_Y.

How to grant network access to LocalSystem account?

How do I grant access to shared folder for local SYSTEM account in domain network

But, the Windows Service is unable to access the file (access denied errors).

dir \\SERVER_X\share
Access is denied.

In the Security Event log (on SERVER_Y) I see that SERVER_X is trying to access the UNC share as NT AUTHORITY\ANONYMOUS LOGON. I would think that I should see the computer account (i.e. DOMAIN\SERVER_X) in the Security Event log.

Both servers are Windows Server 2003 SE SP2.

Any help would be greatly appreciated!