Sunday, February 27, 2011

PSEXEC and system Variables

If you need to get some system variables remotely but you don't want to copy any file on the remote system (for example because you don't know which is the %systemdrive% there are a courple of ways to do that.

Psexec doesn't work with system variables on the remote computer, for example if you type psexec \\anothercomputer cmd /c echo %computername% it will echo hostname of from where you are running psexec.

You might have heard of owexec it will let you run the command you want using the credentials of a loggedon user on the remote computer.

But it's not exactly what I needed, I just need to get system variables and without any user being logged on the remote computer. Plus it uses WMI, and that could be a problem if your computer does have a policy not to allow it.

So it just depends on your imagination:

psexec \\nodito1 cmd /c "for /f "TOKENS=2 DELIMS==" %i in ('set ^| find /i "systemdrive"') do @echo %i" > c:\cerdofunciona.txt
psexec \\nodito1 cmd /c "for /f "TOKENS=2 delims==W" %i in ('set ^| find /i "windir"') do @echo %i" > c:\cerdofuncional.txt
psexec \\nodito1 cmd /c "for /f "TOKENS=* delims==" %i in ('set ^| find /i "computername"') do @echo %i" > c:\edumarcaregistrada.txt

5 comments:

Anonymous said...

This didn't work for me, I ran:

psexec \\inf-vm-manage cmd /c "for /f "TOKENS=* delims==" %i in ('set ^| find /i "computername"') do @echo %i" > c:\edumarcaregistrada.

and got:

PsExec v1.83 - Execute processes remotely
Copyright (C) 2001-2007 Mark Russinovich
Sysinternals - www.sysinternals.com


*" "delims was unexpected at this time.
cmd exited on inf-vm-manage with error code 1.

Pig Bastard said...

Have you run it running a script or typing(by copying and pasting) the command on CMD?

That line will fail to run through a script, you should add one more % to %i

Like: psexec \\inf-vm-manage cmd /c "for /f "TOKENS=* delims==" %%i in ('set ^| find /i "computername"') do @echo %%i" > c:\edumarcaregistrada.txt

Otherwise you will get those errors.

parlevjo said...

Very nice Trick. Now i am able to use the systemroot variable and computername variable of the remote system.

I put everything in a command file and execute that command file.

REM SCRIPT test_psexec_with_variables.cmd
REM EXCUTE: test_psexec_with_variables.cmd computer-to-run-on
set j=%1
ping -n 1 %1%
if errorlevel 1 goto :eof
psexec -s \\%j% cmd /c "for /f "TOKENS=* delims==" %%i in ('set ^| find /i "computername"') do @echo set %%i" > somethingtodotmp.cmd
psexec -s \\%j% cmd /c "for /f "TOKENS=* delims==" %%i in ('set ^| find /i "systemroot"') do @echo set %%i" >> somethingtodotmp.cmd
echo psexec -s \\%j% call "%%systemroot%%\system32\somethingtodo.exe" ^> "%%computername%%.log" 2^>^&1 >> somethingtodotmp.cmd
call somethingtodotmp.cmd

C:\>type somethingtodotmp.cmd
set COMPUTERNAME=SNS120D
set SystemRoot=C:\Windows
psexec -s \\sns120d call "%systemroot%\system32\somethingtodo.exe" > "%computername%.log" 2>&1

yourmt said...

There is a much easier way to do this.
System variables doesn't "work" (actually they work exactly like intended) because of the way the windows command line handles variable expansions. Imagine an environment with 2 PCs (PC1 in DOMAIN1 and PC2 in DOMAIN2) and the following at the command line of PC1:

psexec \\PC2 cmd /c echo %USERDOMAIN%

The system variable %USERDOMAIN% gets expanded before the echo command is sent to the remote host, resulting in the following being executed at the remote host PC2:

echo DOMAIN1

That's why it looks like it does not work.
You need just 1 character to fix this:

psexec \\PC2 cmd /c echo %USERDOMAIN^%

The ^ character is the escape character of the windows command line. It prevents the interpreter at PC1 to expand the variable and lets the remote host PC2 execute what you want it to:

echo %USERDOMAIN%

That finally is parsed by the remote host's interpreter and you get the result you expected:

DOMAIN2

Unknown said...
This comment has been removed by the author.

Post a Comment