Using PSEXEC remotely via PS

PowerShell Help
1

Hi,

Just getting to grips with the syntax of PS and have been tasked with :

[ol]Listing all members of Remote Desktop Users for clients servers
Listing all local accounts for clients servers[/ol]

Regarding the incantations to get the relevant info, I know this works from a PS prompt:

psexec.exe \\SERVERNAME "net" localgroup "Remote Desktop Users"
(Yay Russinovich, right?)

And I know this ALMOST works from a PS prompt:

psexec.exe \\SERVERNAME "net" users
(It bombs out right at the end of showing the local user list with error code 1)

So, I think in PS, from peeping other snippets out there, the following will ALMOST do it:

$computers = Get-Content 'c:\temp\serverlist.txt'

Foreach $computer in $computers {
    psexec.exe \\$computer "net" localgroup "Remote Desktop Users"
    }

It’s \$computer syntax I can’t seem to get right. I also just need to make the loop spit out the computer name and get the remote “net users” to do the business.

Any ideas? I am nearly there, right?

2

Double quotes? “\$computer”

Me, I’d query this with WMI, or via PSRemoting, but that’s me. PSExec is kinda old-school for me. But if it’s what’s in place, and nothing else is an option, sure.

3

Don,

I’ve tried the WMI side this morning but I’d have to visit most of the servers to sort firewall rules on. There are 94 in the list and they want it done ASAP. Some are 2012, some 2008, some 2003, some are wooden beads.

I think I’m going to be doing something 94 times, aren’t I? :frowning:

4

Maybe. Sorting your firewall is going to be of key importance, whether you’re enabling WMI (not very forward-looking, but all you can do on 2003/2008) or allowing WS-MAN traffic (more forward-compatible). If they’re domain-joined, it can be done with a GPO. The firewall can even be modified via PsExec, if that’s in place. But at some point, you’re going to hit a wall with PsExec, and you’ll want to be able to use the better technologies that have been invented in, oh, the last eight years ;).

I mean, hell, ADSI with the WinNT:// provider could do this, and that dates back to 2000. But it isn’t “the way forward.”

I’d argue that getting this done the right way will enable a lot more ASAP in the future. “Investment.” “ROI.” Those are words I’d use.