Running PSExec without the c$ share

Factual Questions
1

I have an application where I need to use the Winternals tool PSEXEC to run commands on a host (one of hundreds, actually) that doesn’t have the default c$ share on it.
Is there a workaround?
Is there a command-line I can run from MY PC to remotely turn on the c$ share on a remote PC?
I know I can create the C$ share on the remote host manually, but I’m trying to create a script for use at hundreds of sites simultaneously, and manual share creation would add considerably to the labor hours on this project.

2

Isn’t it the ADMIN$ share that PsExec requires access to?

If you have sufficient rights to work with Group Policy then you might be better off using login or startup scripts.

3

Why don’t you create the share before running PSExec, then delete it afterwards?

4

You’re right, my bad, I meant to write ADMIN$
These rigs stay up for months straight, so login scripts might take a while to be effective…

5

You can use the output from the NET VIEW command to programatically create the shares.

I don’t have a domain to hand, but if you do NET VIEW /domain:domainname > pcs.txt then edit pcs.txt to remove headers and comments, then you should be able to use

FOR /F %f IN (pcs.txt) DO …

6

Well you could remotely reboot them using the SHUTDOWN command.

However, here’s another idea. Use the SCHTASKS command to a create scheduled task on each machine which runs the NET SHARE command. As Quartz suggested, you can use FOR /F to run this against all the machines in a text file. It might go something like this:


for /F %f in (pcs.txt) do schtasks /create /tn "create admin share" /tr "net share admin$" /sc once /s %f /sd 10/25/08 /st 13:00:00 /ru "NT AUTHORITY\SYSTEM"

Replace both instances of %f with %%f if you run this in a batch script.

I’m not 100% sure that SCHTASKS will work without prior access to the ADMIN$ share, but I think it will.

7

You can use rmtshar.exe from the resource kit, or use this script.

8

If the hosts are not running the Server service, then surely all these suggestions are futile? I don’t think that shutdown.exe, for example, works unless the target is listening for SMB. Which is as it should be, since you don’t want the hosts to be remotely accessible unless they are explicitly running some kind of service.

9

I’m certain that Server.exe is running on these hosts.
I can map from my system to the hosts in question with no trouble.

10

I think this one is probably answered, but anyone who wishes to continue to comment is welcome to.
Thanks to all, with special thanks to yoyodyne and Number!