远程执行命令的psexec工具的基本使用——简单、强大

关于psexec工具的基本使用——简单、强大

    当你工作中需要执行远程命令时，就用到了psexec。psexec使用简单，但是功能却是很强大。下面就来介绍psexec的基本使用方法。

首先下载psexec

[ psexec官方下载地址 ]

    psexec下载完成后，将psexec压缩包解压到你指定的一个路径，比如我将psexec的压缩包解压到d:\psexec 。
    然后，我们就可以开始使用psexec了。打开cmd命令提示符，进入你解压后的文件夹，输入psexec回车，就能看到如下psexec的语法提示：

psexec　语法提示：
PsExec v2.11 - Execute processes remotely
Copyright (C) 2001-2014 Mark Russinovich
Sysinternals - www.sysinternals.com

PsExec executes a program on a remote system, where remotely executed console
applications execute interactively.

Usage: psexec [\computer[,computer2[,…] | @file]][-u user [-p psswd][-n s][-r servicename][-h][-l][-s|-e][-x][-i [session]][-c [-f|-v]][-w directory][-d][-][-a n,n,…] cmd [arguments]
-a Separate processors on which the application can run with
commas where 1 is the lowest numbered CPU. For example,
to run the application on CPU 2 and CPU 4, enter:
“-a 2,4”
-c Copy the specified program to the remote system for
execution. If you omit this option the application
must be in the system path on the remote system.
-d Don’t wait for process to terminate (non-interactive).
-e Does not load the specified account’s profile.
-f Copy the specified program even if the file already
exists on the remote system.
-i Run the program so that it interacts with the desktop of the
specified session on the remote system. If no session is
specified the process runs in the console session.
-h If the target system is Vista or higher, has the process
run with the account’s elevated token, if available.
-l Run process as limited user (strips the Administrators group
and allows only privileges assigned to the Users group).
On Windows Vista the process runs with Low Integrity.
-n Specifies timeout in seconds connecting to remote computers.
-p Specifies optional password for user name. If you omit this
you will be prompted to enter a hidden password.
-r Specifies the name of the remote service to create or interact.
with.
-s Run the remote process in the System account.
-u Specifies optional user name for login to remote
computer.
-v Copy the specified file only if it has a higher version number
or is newer on than the one on the remote system.
-w Set the working directory of the process (relative to
remote computer).
-x Display the UI on the Winlogon secure desktop (local system
only).
-priority Specifies -low, -belownormal, -abovenormal, -high or
-realtime to run the process at a different priority. Use
-background to run at low memory and I/O priority on Vista.
computer Direct PsExec to run the application on the remote
computer or computers specified. If you omit the computer
name PsExec runs the application on the local system,
and if you specify a wildcard (\*), PsExec runs the
command on all computers in the current domain.
@file PsExec will execute the command on each of the computers listed
in the file.
cmd Name of application to execute.
arguments Arguments to pass (note that file paths must be
absolute paths on the target system).
-accepteula This flag supresses the display of the license dialog.

You can enclose applications that have spaces in their name withquotation marks e.g. psexec \marklap “c:\long name app.exe”.
Input is only passed to the remote system when you press the enterkey, and typing Ctrl-C terminates the remote process.

If you omit a user name the process will run in the context of youraccount on the remote system, but will not have access to networkresources (because it is impersonating). Specify a valid user namein the Domain\User syntax if the remote process requires accessto network resources or to run in a different account. Note thatthe password and command is encrypted in transit to the remote system.
Error codes returned by PsExec are specific to the applications you execute.

  在psexec [\\computer[,computer2[,...] | @file]][-u user [-p psswd][-n s][-r servicename][-h][-l][-s|-e][-x][-i [session]][-c [-f|-v]][-w directory][-d][-<priority>][-a n,n,...] cmd [arguments]指令中，中括号内的是可选参数，括号外的是必须的参数。各参数对应的意思，可以在上述英文中看到。
    出现上述提示说明你的psexec可以正常使用。然后，开始调用远程EXE文件，比如我的远程IP为：192.168.0.117，用户名使用管理员权限：Administrator，密码为：Win2008 ，要执行的EXE在c:\test1.exe，具体命令及结果如下：

上图中的异常提示说，在非用户交互模式下不可以打开模态对话框或者form程序（我要调用的test1.exe是对话框类型的）。所以我们执行命令时要指定用户交互模式，加上“-i”。如下：

然后，远程EXE就调用成功了。读者可以根据自己需要，加上不同的参数，来使用psexec执行一些远程命令。