PowerShell commands can be executed on a remote systems by using PowerShell-Remoting. By default, PowerShell remoting is disabled on clients operating systems.

We can either enable PowerShell remoting by executing the command “Enable-PSRemoting -Force” under administrative context. This can be either done locally on each systems by executing the commands or remotely via a group policy or through SCCM.

But if we have administrative access to a system, we can execute PowerShell commands remotely by means of PSEXEC.EXE (https://docs.microsoft.com/en-us/sysinternals/downloads/psexec)

PSEXEC shell does not work well (interactively) with PowerShell as it works with cmd commands.

Interactive Powershell prompt with PSExec

In windows 10, the interactive part is much better.

Enabling PowerShell Remoting using PSEXEC

#cmd.exe in the administrative context
#navigate to the sysinternals tools folder or add the folder to the PATH
#executing the below command would take us to the powershell prompt of the remote system
psexec.exe \\<computerName powershell.exe

#run the below command to enable PS Remoting or any commands as we wish
Enable-PSRemoting -Force

Execute multiple Powershell commands with PSExec

So, rather than going with interactive way, we can also issue a single command to do the same task

#navigate to the sysinternals suite folder, to directly execute from the prompt, add the folder to the PATH
psexec.exe \\<computerName> powershell.exe -command "& {Enable-PSRemoting -Force}"

Execute multiple Powershell commands with PSExec

We can also execute multiple commands as a single statement

#navigate to the sysinternals suite folder, to directly execute from the prompt, add the folder to the PATH
psexec.exe \\<computerName> powershell.exe -command "& {Get-Process; Get-service; $num1 = 2; $num2 = 1; $num1 + $num2}"

Also, please have a look at my other post about PSEXEC

Hope you liked this article and thank you for reading

Connect to remote cmd prompt ?

# Below command connect to remote system in interactive mode through cmd
psexec.exe  \\pcname  cmd

And the best part, PsExec can run the process with system account !!! WoW

Change local user password in more than one computer

# Create a file with computer names and execute the below command to change admin password in remote systems

psexec.exe  @pcname.txt  cmd /c "net user administrator complexpassword123:)"

The dangerous one – Runs in all system within the domain

 psexec.exe  \*  cmd /c "net user administrator complexpassword123:)" 

Hope you like this article and thank you for reading.