Sunday, September 11, 2011

Automation with Psexec on Windows

PsTools a great utility tools to connect to remote machine and perform various management operations, by SysInternals (now purchased by Microsoft). One of which is PSEXEC, capable of performing various operations on windows remotely. There are somethings to remember before you proceed
  1. Run with administrative privileges on remote machine
  2. Avoid services to run as Local System Account, if you wish to run a PSEXEC with CI servers. (Local Systems Account has less privileges)
  3. Windows 7 & Windows 2008 server need elevated privileges to complete operations
    with Psexec
  4. You should know Administrative Account & password to connect to remote system.
  5. Remote Desktop Should be enabled (Terminal Service)


psexec [\\computer[,computer2[,...] | @file]][-u user [-p psswd][-n s][-l
][-s|-e][-x][-i [session]][-c [-f|-v]][-w directory][-d][-<priority>][-a n,n,...
] cmd [arguments]

-a Separate processors on which the application can run with
commas where 1 is the lowest numbered CPU. For example, to run the application
on CPU 2 and CPU 4, enter: "-a 2,4"
-c Copy the specified program to the remote system for execution. If you omit
this option the application must be in the system path on the remote system.
-d Don't wait for process to terminate (non-interactive).
-e Does not load the specified account's profile.
-f Copy the specified program even if the file already exists on the remote
-i Run the program so that it interacts with the desktop of the specified
session on the remote system. If no session is specified the process runs in the
console session.
-h If the target system is Vista or higher, has the process run with the
account's elevated token, if available.
-l Run process as limited user (strips the Administrators group and allows only
privileges assigned to the Users group). On Windows Vista the process runs with
Low Integrity.
-n Specifies timeout in seconds connecting to remote computers. -p Specifies
optional password for user name. If you omit this you will be prompted to enter
a hidden password.
-s Run the remote process in the System account. -u Specifies optional user name
for login to remote computer. -v Copy the specified file only if it has a higher
version number or is newer on than the one on the remote system. -w Set the
working directory of the process (relative to remote computer).
-x Display the UI on the Winlogon secure desktop (local system only).
-priority Specifies -low, -belownormal, -abovenormal, -high or -realtime to run
the process at a different priority. Use -background to run at low memory and
I/O priority on Vista.
computer Direct PsExec to run the application on the remote computer or
computers specified. If you omit the computer name PsExec runs the application
on the local system, and if you specify a wildcard (\\*), PsExec runs the
command on all computers in the current domain.
@file PsExec will execute the command on each of the computers listed in the
program Name of application to execute.
arguments Arguments to pass (note that file paths must be absolute paths on the
target system).
You can enclose applications that have spaces in their name with quotation marks
e.g. psexec \\marklap "c:\long name app.exe". Input is only passed to the remote
system when you press the enter key, and typing Ctrl-C terminates the remote
If you omit a user name the process will run in the context of your account on
the remote system, but will not have access to network resources (because it is
impersonating). Specify a valid user name in the Domain\User syntax if the
remote process requires access to network resources or to run in a different
account. Note that the password is transmitted in clear text to the remote
system. Error codes returned by PsExec are specific to the applications you
execute, not PsExec.

Advance use of PSEXEC

Install\Uninstall a package
Install and Uninstall package from remote machine i.e, msi/exe/msm
psexec -i 0 -u Admin -pass @dmin \\[COMPUTER NAME\IP] cmd /c msiexec /i package.msi

psexec -i 0 -u Admin -pass @dmin \\[COMPUTER NAME\IP] cmd /c msiexec /x {ProductCode-GUID}
But you need to copy the msi to the remote computer in order to install the msi in the above command. [-c] operators provides the soluton to this problem
Go to path to msi on local system and then execute the psexec as shown in below example:-
pushd "C:\product"

psexec -i 0 -c -u admin -p pass \\[COMPUTER NAME\IP] cmd /c msiexec /i package.msi
There can be various ways of installing msi through psexec
  1. Share the folder

    psexec -i 0 -u admin -p pass \\[COMPUTER NAME\IP] cmd /c msiexec /i \\servernmae\Share\package.msi
  2. FTP/SCP/xcopy/copy - you should know exact copied path of msi on SERVER

    psexec -i 0 -u admin -p pass \\[COMPUTER NAME\IP] cmd /c msiexec /i C:\product\package.msi
  3. Map Drive to Shared Folder

    psexec -i 0 -u admin -p pass \\[COMPUTER NAME\IP] cmd /c net use x: \\[SERVER NAME\IP]\Share

    psexec -i 0 -u admin -p pass \\[COMPUTER NAME\IP] cmd /c msiexec /i x:\package.msi
Terminal Server to Destination Server
There are going to be many instances when you may need to connect to a server and from that server to another to do the installations, in case of Virtual Environments.

For example
You have Group of Servers for DEVELOPMENT -> DEV Which has 10 servers
You have Group of similar Servers for Testing -> QA Which has 10 servers
But these groups have only one server for each group exposed to firewall then, how you are going to do the Installation or any other activity
Hers is an example :-

psexec -i 0 -u admin -p pass \\ServerName0\IP psexec \\ServerName1\IP cmd /c msiexec /i x:\package.msi
I have assumed thet user name password are similar for all the Boxes in Sandbox Environment, if not see the beloe example
psexec -i 0 -u admin -p pass \\ServerName0\IP psexec -u admin1 -p pass1 \\ServerName1\IP cmd /c msiexec /i x:\package.msi
Other things
You can do lot of things from psexec if you are using it for Continuous Integration, it is great utility for Automated Deployment. I am using it for following things and others to like Subversion administration from Jenkins Jobs, like backup, dump, restoration, create repository etc. I have used various tools to run on remote system like running SQL scripts, updating text files etc. Below are some things which you can do remote system.
  1. Sharing\Unsharing Folders on Remote machines
  2. Mapping Drives
  3. run various exe on remote servers
  4. Deleting\Creating folders
  5. Invoke remote scripts
  6. Pinging to check if host is available or not
  7. Copy msi/scripts to remote server
  8. Add/Delete Users
  9. Start/Stop Services (includes IIS)
  10. logon to wmic
  11. Run QTP, Selnium Scripts

No comments:

Post a Comment