CODEWITHSUNDEEP
vbscript
ScriptNoob
ScriptNoob

Reputation: 13

Run BAT file on remote server using VBScript. No psexec, and as a different user

I'm trying to execute a a BAT file on a remote server using VBScript. Further requirements:

I have consulted this article: https://learn.microsoft.com/en-us/windows/desktop/WmiSdk/connecting-to-wmi-remotely-with-vbscript

I see how creating the connection works, but I can't figure out how to then create a process using that same connection.

I believe this solution is really close, the only problem is I think it impersonates the user of the computer it is currently running on:

strCommand = "C:\temp\copyall.bat"
strPath = "C:\temp"
strcomputer="."

process = "winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2"
msgbox process

Set objWMIService = GetObject(process)
Set objProcess = objWMIService.Get("Win32_Process")

errReturn = objProcess.Create(strCommand, strPath, Null, intProcessID)

If errReturn = 0 Then
      WScript.Echo "scan success: " & intProcessID
Else
      WScript.Echo "scan fail: " & errReturn
End If

This example from Microsoft's site shows how to create the connection properly but I don't know how to then use that connection.

' Full Computer Name
' can be found by right-clicking My Computer,
' then click Properties, then click the Computer Name tab)
' or use the computer's IP address
strComputer = "FullComputerName" 
strDomain = "DOMAIN" 
Wscript.StdOut.Write "Please enter your user name:"
strUser = Wscript.StdIn.ReadLine 
Set objPassword = CreateObject("ScriptPW.Password")
Wscript.StdOut.Write "Please enter your password:"
strPassword = objPassword.GetPassword()

Set objSWbemLocator = CreateObject("WbemScripting.SWbemLocator")
Set objSWbemServices = objSWbemLocator.ConnectServer(strComputer, _
                                                     "Root\CIMv2", _
                                                     strUser, _
                                                     strPassword, _
                                                     "MS_409", _
                                                     "ntlmdomain:" + strDomain)
Set colSwbemObjectSet = objSWbemServices.ExecQuery("Select * From Win32_Process")
For Each objProcess in colSWbemObjectSet
    Wscript.Echo "Process Name: " & objProcess.Name 
Next

The answer is probably staring me in the face but I just can't see it right now. Ideas?

Upvotes: 1

Views: 864

Answers (1)

Ansgar Wiechers
Ansgar Wiechers

Reputation: 200443

After connecting to the remote server simply get the Win32_Process object and call the Create() method like you'd do locally.

Set objSWbemServices = objSWbemLocator.ConnectServer(...)
Set objProcess = objSWbemServices.Get("Win32_Process")
errReturn = objProcess.Create(strCommand, strPath, Null, intProcessID)

The file you want to run must exist locally on the remote server for this to work.

Also note that this normally requires admin privileges on the remote system.

Upvotes: 1

Related Questions