WMIC流程调用开始无法远程运行

Question

Here's the info: Currently we're working on how to execute a batch file on another server, but since we're on research and testing phase we're currently working on our client PC. I tried to run using this command:

wmic /user:<username> /password:<password> /node:<machine_name> process call create "cmd /c E:\sharedfolder\try_wmic.bat"

Is it necessary to work on this by an administrator account, or did I miss something?

Thanks and I appreciate all your feedback :)

Answer 1

wmic created processes start with no network privileges. Even attempting to use UNC network paths can fail if you are accessing a Windows 10 machine. Something like the following will work:

wmic /node:"computername" process call create "cmd.exe /c (net use /user:\"DOMAIN\AdminUser\" x: \\machine\share \"YourPassword\" && dir x:\ && net use x: /delete ) > c:\test.txt"

With the obvious caveat that you are passing credentials in plain text.

The issue is that in order to create a process on another machine you need elevated privileges, and with elevated privileges your normal network mappings are no longer available. It is as though there are two different admin users: one when the admin user is doing normal things and another when the admin user invokes those privileges (for instance to create a process on another machine).

As an example of the issue, if you did not remove the drive mapping to X: as I did in my example and targeted a Windows 10 machine with that command, a normal user might see the mapping, but would be unable to use it: 'net use' would show the drive was 'Unavailable' and attempting to access it would result in 'The system cannot find the path specified'.