PSEXEC versus Windows PowerShell Remote v 2.0

Question

_{Monday, January 3, 2011 10:01 PM | 1 vote}

Hello,

I'm trying to figure out the pros and cons of PsExec and the other PsTools versus Windows PowerShell Remote v 2.0.

It seems like the upsides of Windows PowerShell Remote v 2.0 would be

* Richer scripting enviroronment (could partially alleviate this by running PsTools in a Powershell console).

Upsides of PsTools would be:

*Nothing to install or configure on the server that you're managing besides making sure firewall rules, etc. will allow it.

Is there anything that you can do with Windows PowerShell Remote v 2.0 that you can't do with PsTools, or vice versa?

Thanks,

Eric

All replies (6)

_{Tuesday, January 4, 2011 4:09 PM ✅Answered}

One difference is the protocols involved.  PS remoting uses http/https and PSEXEC uses RPC.  If there's a firewall between you and the remote system you'll have a lot better luck getting it to work with PS Remoting than with PSEXEC. IMHO.[string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " "

_{Wednesday, January 5, 2011 8:55 PM ✅Answered}

Another difference is that PSExec allows you to run things under the System account.  Not a lot of places where this would be required, but it is available.  Also, if you work in a place where for one reason or another that powershell remoting is not allowed, you can use PSexec as a workaround to do things remotely, although you won't have the level of interaction that you would with PowerShell remoting.

_{Thursday, January 6, 2011 2:31 AM ✅Answered}

The security disadvantage I've seen with using PSExec is that it transmits usernames/passwords in clear text across your network... this is noted under PSExec.exe /help

WinRM can be configured to use HTTPS which encrypts traffic between server/client.

An advantage of using PSExec is that it's easy to access a third machine... from your desktop you can start a command prompt on another machine and execute something from a network share/third machine.

You can do this with with WinRM/PS but you have to configure 'Trusted for Delegation' in AD... there's a thread on here somewhere with the details... again this could be considered a security risk.

The way around this is to copy the install files to the remote machine before you do your invoke-command or WMI install/execute on the remote machine... which means File/Print Sharing enabled and firewall configured to allow it.

For large installs this may be impractical.

Just a humble SysAdmin

_{Thursday, January 6, 2011 8:38 PM ✅Answered}

I think the major benefits of PowerShell remoting are in the fan-out capabilities. It's very easy to run a command against multiple computers in parallel.

For example, I could query event logs by passing an array of computernames to a foreach loop, and my script would connect to each computer one by one to collect the information.

$results = ($computers | % {Get-WinEvent -FilterHashtable @{logname="System";ID="27"} -ComputerName $_})

Or I could pass my array of names to Invoke-Command and query dozens of computers in parallel.

$results = (Invoke-Command -ComputerName $computers -ScriptBlock {Get-WinEvent -FilterHashtable @{logname="System";ID="27"}})

_{Tuesday, January 4, 2011 3:58 PM}

there are a couple weird things you cant do with PS remoting (scan forums for psexec and you'll find a few) but most you are unlikely to run in to. other than that, its mostly just preference as to how you'd like to do things.

personally I prefer to keep things within powershell just to simplify things. using psexec makes it a tad more convoluted.

up to you though, one way isnt way better than the other.

_{Monday, February 21, 2011 11:14 AM}

I'm using powershell remoting a lot to execute background scripts on computers, even when those are not logged in.

Psexec sometimes comes in very handy when I want to launch something visual on a lot of pc's. That happens often in our classroom environment when I have to make an installation or setting that is impossible to run silent. In those cases it saves me a lot of time simply copying and running the setup using psexec before I start clicking away on the computers.