code:

---

  
Break On
$RemoteBox = "your remote hostname here" ;No \\
$ServerShr = "\\Server\share"

$RCommand = "cmd /c Dir C:\>c:\output.txt & pause"              ;Local Command
;$RCommand = "cmd /c Dir C:\>$ServerShr\output.txt & pause"     ;Remote Command Fails

$Connect = GetObject("winmgmts:{impersonationLevel=impersonate}!//$RemoteBox/root/cimv2:Win32_Process")
? @serror
$Process = $Connect.Create($RCommand)
? @serror

If NOT $Process
    ? "Process executed successfully!"
Else
    ? "Process failed..."  
EndIf

$Connect=""
$Process=""

:END

---

code:

---

  
Break On
$RemoteBox = "your remote hostname here" ;No \\
$ServerShr = "\\Server\share"
$ID = "Domain\UserID"   ; Use any account with local admin rights
$PW = "Password"        ; Obvious security concerns

$RCommand = "cmd /c Dir C:\>c:\output.txt & pause"              ;Local Command works
;$RCommand = "cmd /c Dir C:\>$ServerShr\output.txt & pause"     ;Remote Command fails

$Connect = CreateObject("WbemScripting.SWbemLocator")
? @serror
$Con2 = $Connect.ConnectServer("$remotebox","root\cimv2","$ID","$PW")
? @serror
$Con3 = $Con2.Get("Win32_Process")
? @serror
$Process = $Con3.Create($RCommand)
? @serror

If NOT $Process
    ? "Process executed successfully!" 
Else
    ? "Process failed..."  
EndIf

$Connect=""
$Process=""
$Con2=""
$Con3=""

:END

---

Switch the $Commands, in both cases the remote fails... I have been upside down the SDK and the MSDN. I beg of someone, anyone, please, please, please, provide me with the answer! I will consider naming my first born after you! (My wife probably wont agree though...

I'm desperate!

-Jim

Note: I will UDF these after I figure this last one out.

quote:

---

The service is run under the built-in 'SystemAccount'.
MSDN gives an alternative:
"You could add the REG_DWORD value named "RestrictNullSessAccess" to the following registry key and set it to 0 to allow all null sessions to access all pipes and shares created on that machine. "

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
LanmanServer\Parameters\

---

Thought that might apply...

[ 20 May 2002, 23:35: Message edited by: jtokach ]

quote:

---

When you use Telnet to map a drive letter to a network share, the procedure may not work and the following error message may be displayed:

A specified logon session does not exist. It may already have been terminated.
NOTE : This problem does not affect Telnet sessions for which the user authentication method is clear text.

CAUSE
This issue occurs when you open a Telnet session to a computer running Windows NT Server using the NTLM authentication method. You cannot then, from within the Telnet session, connect to network resources using your implied user credentials. You must explicitly specify your credentials when making network connections from within the Telnet session.

There is no mechanism in Windows NT to perform delegation of security (pass through) for network logon attempts.

For example, if you log on to the network using NTLM from computer A to computer B, and then type "net use" at a command prompt to connect to computer C from computer B, the connection is not made. The reason is that computer B has an incomplete user token (it does not have your password), so the logon attempt to computer C does not work. This behavior is rooted in NTLM being a challenge/response protocol, and as such, it avoids sending your password across the network.

---

quote:

---

I am seeking a solution using any scripting language, (KIX, VBS, JS with WMI or WSH or any other means) to connect to a remote box and access the network through that box, without using tools like SU.EXE or PSEXEC.EXE. I have managed to connect via all languages and means, but I keep running into the dreaded ERROR 1312 - A specified logon session does not exist. It may already have been terminated. Is there any way around this using a scripting language?

---

quote:

---

So you wish to establish something like a remote console on the target machine? Kind of like a telnet session? Or are you simply trying to access the file system on the remote machine?

---

quote:

---

I can already connect to the remote machine using the impersonate method in WMI or the WSHController object in WSH, unfortunately when I am connected, I do not have access to network resources through the remote box. It is like a Telnet session already...

---

quote:

---

Ahh. You are running into the classic delegation problem. You are trying to make two network hops with your credentials. This won’t work by default, and I’m not sure you even *want* it to work unless you really trust that remote box to which you’d delegate your credentials.

---

quote:

---

You hit it on the nose. Unfortunately, delegation, from what I understand, will only work under Kerberos authentication supplied by AD. ...I don't think VBS or Kix are capable enough to handle any other required means...

---

quote:

---

If you’re using NTLM, then the only way to delegate your credentials would be to send your password to the remote machine, using an encrypted link. NTLM does support encryption, but you won’t be doing this via scripting languages anytime soon, as you’ve pointed out.

---

quote:

---

Includes the new scriptable objects that will make administrator's life more easy. TqcRunas objects can be used in any scripting language that supports ActiveX (COM) objects, for example JavaScript, VBScript and KiXtart.

---