7

As you can see from the screenshot below, C:\Windows\system32\cmd.exe exists (since the command prompt itself is using that path), and I try referencing it both with the short cmd.exe name and the full path, but both result in the same error from PsExec.exe:

The system cannot find the specified file.

The Network Service user does exist; if I mistype if I get a password prompt and message saying that the username password does not exist.

I receive this error message on multiple computers, but it works on others; with a mix of Windows Server 2008 R2 and 2012 R2. I and am using the latest version of PsExec.exe, which is currently 2.11, and am running the command prompt that I use to launch PsExec as admin, so it should have any necessary permissions.

I've found lots of posts about seeing this problem when running PsExec on a remote machine, but none for the local machine, which I am doing.

Any ideas on what is the problem?

enter image description here

deadlydog
  • 804

6 Answers6

1

The fix ended up being to NOT run the command prompt that I was launching PsExec from as admin. If I run the command from a cmd prompt running as Admin, I get the error. If I run it from a non-elevated command prompt, it works fine.

deadlydog
  • 804
0

Another reason this may happen is you have stopped or disabled LanmanServer (Server) or LanmanWorkstation (Workstation) services.

The way PsExec works, it needs those to function.

himself
  • 109
0

I also found that if I copy PSExec to another directory (and the Sysinternals directory is not on PATH) and try to run it from there, it will fail as above. If I run PSExec on the Sysinternals directory then the -s option will work.

So, another item to check is to make sure that either the Sysinternals folder is on the path or that PSExec is executed from that directory.

Apparently, it needs another Sysinternals executable...

Andres S
  • 1
0

I had the same problem, the solution was to disable windows defender's Real-Time protection. This was blocking the psexec operation.

Gil Cohen
  • 101
0

What fixed it for me was executing the 'psexec' command from the default cmd location (c:\windows\system32 in my case) and give the full path to the argument (the app you're running):

C:\WINDOWS\system32>psexec c:\Projects\newdesktop\someapp.exe

Alonzzo2
  • 101
0

To add to the answers here, this also happens when the file you are trying to read is encrypted using Windows native encryption features (eg. EFS).

When running psexec and adding the -s switch, it tries to run/open the file using the SYSTEM account. If you have enabled Windows EFS encryption on that file (or the folder it's in), it will be encrypted with your user's encryption certificate, and SYSTEM won't be able to read it. This will produce the 'file not found error'.

To allow the SYSTEM account to read it, you can install the encryption certificate in the SYSTEM certificate store, or give system per-file access to the files/folders you want it to have access to.

https://stackoverflow.com/questions/8909090/the-system-account-cannot-access-the-certificate-store

How do I let the SYSTEM account use EFS encryption?

Dale Newton
  • 99