1

I don't have much experience in protecting windows machines, so sorry if I'm missing something obvious; how would one protect from psexec without disabling SMB? One could disable the admin$ share, but I've read here and there that it can cause some applications to misfunction. Is it something that can be handled by a local anti-virus? Sorry for the vagueness of my question, I have looked around but I wasn't able to find much. Thanks for any answer.

Edit for clarification: in short, I'd like to know whether it's possible to share data via SMB without allowing people to execute commands on my machine via psexec.

  • Are you using windows EMET? – mootmoot Sep 17 '18 at 13:02
  • @mootmoot I'm not asking about a specific use case, more in the general case. Does EMET block psexec? – Nico Sep 17 '18 at 13:05
2

For psexec to work, you must already have local admin credentials for the target. If you don't want people using psexec to a given computer, the proper solution is to not give them admin rights there. Otherwise, they could just undo whatever you do anyway.

  • So a user without local admin rights can access a SMB share but not use psexec? – Nico Sep 17 '18 at 13:16
  • 1
    Right. SMB itself doesn't require local admin to use, but psexec does a lot of things that do. – Joseph Sible Sep 17 '18 at 13:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.