1

I don't have much experience in protecting windows machines, so sorry if I'm missing something obvious; how would one protect from psexec without disabling SMB? One could disable the admin$ share, but I've read here and there that it can cause some applications to misfunction. Is it something that can be handled by a local anti-virus? Sorry for the vagueness of my question, I have looked around but I wasn't able to find much. Thanks for any answer.

Edit for clarification: in short, I'd like to know whether it's possible to share data via SMB without allowing people to execute commands on my machine via psexec.

Improve this question
2
  • Are you using windows EMET?
    – mootmoot
    Commented Sep 17, 2018 at 13:02
  • @mootmoot I'm not asking about a specific use case, more in the general case. Does EMET block psexec?
    – Nico
    Commented Sep 17, 2018 at 13:05

1 Answer 1

Reset to default
2

For psexec to work, you must already have local admin credentials for the target. If you don't want people using psexec to a given computer, the proper solution is to not give them admin rights there. Otherwise, they could just undo whatever you do anyway.

Improve this answer
2
  • So a user without local admin rights can access a SMB share but not use psexec?
    – Nico
    Commented Sep 17, 2018 at 13:16
  • 1
    Right. SMB itself doesn't require local admin to use, but psexec does a lot of things that do.
    – Joseph Sible-Reinstate Monica
    Commented Sep 17, 2018 at 13:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .