none
Psexec fails with error "Could not start PSEXESVC service... %1 is not a valid Win32 application" RRS feed

  • Question

  • The command below:

    psexec \\[hostname] -u [domain]\[userid] -p [password] "cmd.exe"
    

    returns error: Could not start PSEXESVC service on [hostname]: %1 is not a valid Win32 application.

    I noticed that that C:\Windows on [hostname] contains a "psexesvc.exe" with size 0 bytes. From what I've found online so far, psexec copies psexesvc. Any ideas what may be going on here?

    Thanks in advance!


    • Edited by PBrain007 Monday, June 24, 2019 9:49 PM
    Monday, June 24, 2019 9:29 PM

All replies

  • Probably an antivirus or APplocker blocking the installation of the PSExecSvc...

    Thanks
    -mario

    Tuesday, June 25, 2019 7:09 AM
  • Just tried again after disabling anti-virus. Still see the same behavior.

    Thanks for your suggestion!

    Tuesday, June 25, 2019 4:33 PM
  • Is it still an installed service PSEXECSVC?
    you can check with SC query and if it is uninstall it with SC delete..

    Did you already deleted the file from c:\windows and rebooted the machine?

    Thanks

    -mario

    Tuesday, June 25, 2019 6:58 PM
  • I did these steps:

    C:\Windows\System32>sc delete psexesvc
    [SC] DeleteService SUCCESS

    Deleted the PSExesvc under c:\Windows

    Rebooted the machine. Then tried psexec. Still see the same error and psexesvc file with zero bytes size :-(

    PsExec v2.2 - Execute processes remotely
    Copyright (C) 2001-2016 Mark Russinovich
    Sysinternals - www.sysinternals.com

    Could not start PSEXESVC service on[hostname]:
    %1 is not a valid Win32 application.

    Thank you!

    Tuesday, June 25, 2019 9:15 PM
  • It's time for Process Monitor..

    perform the same step as before, delete the service and reboot the machine, then start process monitor on the host where you would like to start the psexecsvc. Start to capture a trace just before running on the remote machine the psexec command.

    Save the trace in pml native format saving all the events and share the trace.

    Thanks
    -mario 

    Wednesday, June 26, 2019 7:00 AM
  • Try manually copy PsExecsvc  into C:\Windows of the computer.
    Thursday, October 3, 2019 1:39 PM