# Running PSExec without the c$ share **URL:** \ **Category:** Factual Questions\ **Created:** [October 24, 2008, 6:41pm UTC](https://boards.straightdope.com/t/running-psexec-without-the-c-share/469407 "2008-10-24T18:41:02Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Mr.Slant](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@Mr.Slant](https://boards.straightdope.com/u/Mr.Slant)\ **Post date:** [October 24, 2008, 6:41pm UTC](https://boards.straightdope.com/t/running-psexec-without-the-c-share/469407/1 "2008-10-24T18:41:02Z")
I have an application where I need to use the Winternals tool PSEXEC to run commands on a host (one of hundreds, actually) that doesn’t have the default c$ share on it. Is there a workaround? Is there a command-line I can run from _MY_ PC to remotely turn on the c$ share on a remote PC? I know I can create the C$ share on the remote host manually, but I’m trying to create a script for use at hundreds of sites simultaneously, and manual share creation would add considerably to the labor hours on this project. ---
**Author:** ![Number](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/number/32/242_2.png) [@Number](https://boards.straightdope.com/u/Number)\ **Post date:** [October 25, 2008, 2:59am UTC](https://boards.straightdope.com/t/running-psexec-without-the-c-share/469407/2 "2008-10-25T02:59:31Z")
Isn’t it the ADMIN$ share that PsExec requires access to? If you have sufficient rights to work with Group Policy then you might be better off using login or startup scripts. ---
**Author:** ![Quartz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/quartz/32/267_2.png) [@Quartz](https://boards.straightdope.com/u/Quartz)\ **Post date:** [October 25, 2008, 8:39am UTC](https://boards.straightdope.com/t/running-psexec-without-the-c-share/469407/3 "2008-10-25T08:39:18Z")
Why don’t you create the share before running PSExec, then delete it afterwards? ---
**Author:** ![Mr.Slant](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@Mr.Slant](https://boards.straightdope.com/u/Mr.Slant)\ **Post date:** [October 25, 2008, 12:27pm UTC](https://boards.straightdope.com/t/running-psexec-without-the-c-share/469407/4 "2008-10-25T12:27:34Z")
> [@Number](#): > > Isn’t it the ADMIN$ share that PsExec requires access to? > > If you have sufficient rights to work with Group Policy then you might be better off using login or startup scripts. You’re right, my bad, I meant to write ADMIN$ These rigs stay up for months straight, so login scripts might take a while to be effective… ---
**Author:** ![Quartz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/quartz/32/267_2.png) [@Quartz](https://boards.straightdope.com/u/Quartz)\ **Post date:** [October 25, 2008, 1:01pm UTC](https://boards.straightdope.com/t/running-psexec-without-the-c-share/469407/5 "2008-10-25T13:01:49Z")
You can use the output from the NET VIEW command to programatically create the shares. I don’t have a domain to hand, but if you do NET VIEW /domain:domainname \> pcs.txt then edit pcs.txt to remove headers and comments, then you should be able to use FOR /F %f IN (pcs.txt) DO … ---
**Author:** ![Number](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/number/32/242_2.png) [@Number](https://boards.straightdope.com/u/Number)\ **Post date:** [October 25, 2008, 2:35pm UTC](https://boards.straightdope.com/t/running-psexec-without-the-c-share/469407/6 "2008-10-25T14:35:42Z")
> [@Mr.Slant](#): > > You’re right, my bad, I meant to write ADMIN$ > These rigs stay up for months straight, so login scripts might take a while to be effective… Well you could remotely reboot them using the [SHUTDOWN](http://www.ss64.com/nt/shutdown.html) command. However, here’s another idea. Use the [SCHTASKS](http://www.ss64.com/nt/schtasks.html) command to a create scheduled task on each machine which runs the [NET SHARE](http://www.ss64.com/nt/net_share.html) command. As **Quartz** suggested, you can use [FOR /F](http://www.ss64.com/nt/for_f.html) to run this against all the machines in a text file. It might go something like this: ```auto for /F %f in (pcs.txt) do schtasks /create /tn "create admin share" /tr "net share admin$" /sc once /s %f /sd 10/25/08 /st 13:00:00 /ru "NT AUTHORITY\SYSTEM" ``` Replace both instances of %f with %%f if you run this in a batch script. I’m not 100% sure that SCHTASKS will work without prior access to the ADMIN$ share, but I think it will. ---
**Author:** ![yoyodyne](https://avatars.discourse-cdn.com/v4/letter/y/a9a28c/32.png) [@yoyodyne](https://boards.straightdope.com/u/yoyodyne)\ **Post date:** [October 25, 2008, 6:42pm UTC](https://boards.straightdope.com/t/running-psexec-without-the-c-share/469407/7 "2008-10-25T18:42:37Z")
You can use rmtshar.exe from the resource kit, or use this [script.](http://www.microsoft.com/technet/scriptcenter/resources/qanda/jan05/hey0107.mspx) ---
**Author:** ![Ximenean](https://avatars.discourse-cdn.com/v4/letter/x/aca169/32.png) [@Ximenean](https://boards.straightdope.com/u/Ximenean)\ **Post date:** [October 25, 2008, 6:59pm UTC](https://boards.straightdope.com/t/running-psexec-without-the-c-share/469407/8 "2008-10-25T18:59:42Z")
If the hosts are not running the Server service, then surely all these suggestions are futile? I don’t think that shutdown.exe, for example, works unless the target is listening for SMB. Which is as it should be, since you don’t want the hosts to be remotely accessible unless they are explicitly running some kind of service. ---
**Author:** ![Mr.Slant](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@Mr.Slant](https://boards.straightdope.com/u/Mr.Slant)\ **Post date:** [October 25, 2008, 11:27pm UTC](https://boards.straightdope.com/t/running-psexec-without-the-c-share/469407/9 "2008-10-25T23:27:27Z")
I’m certain that Server.exe is running on these hosts. I can map from my system to the hosts in question with no trouble. ---
**Author:** ![Mr.Slant](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@Mr.Slant](https://boards.straightdope.com/u/Mr.Slant)\ **Post date:** [October 25, 2008, 11:29pm UTC](https://boards.straightdope.com/t/running-psexec-without-the-c-share/469407/10 "2008-10-25T23:29:12Z")
I think this one is probably answered, but anyone who wishes to continue to comment is welcome to. Thanks to all, with special thanks to yoyodyne and Number!