7

Situation:

Running PsExec takes 20 seconds with the Windows firewall active, and 1 second with it disabled.

Exceptions added to the firewall:

Without these two it won't connect at all. Target machine running windows 10. During the 20 second wait it sits saying "Starting PsEXESVC on "

A little wiresharking shows us that we need to also open another port which is being requested.

  • first time I ran this it was 49669 second time it was 49670

No idea why nor what range it will accept, any ideas?

Is there a definitive list of what ports PSEXEC needs to have opened?

failure to move to a different port introducing delay with windows firewall enabled on windows 10 (all inbound "Remote..." firewall rules are enabled )

Improve this question
1
  • It's interesting that it works at all if your firewall is blocking RPC.
    – Ryan Ries
    Jan 23, 2016 at 23:10

5 Answers 5

Reset to default
8

Apparently this is an issue with the Group Policy client when enabling "Remote Service Management".

The fix is to run the following command:

netsh advfirewall firewall set rule name="Remote Service Management (RPC)" profile=domain new enable=yes

I did this in bulk, remotely, using PsExec (which ran slowly) as follows, given the affected workstations, one computer name per line, in workstations.txt:

for /f %i in (workstations.txt) do @start /B psexec \\%i netsh advfirewall firewall set rule name="Remote Service Management (RPC)" profile=domain new enable=yes

Doing psexec @workstations.txt (instead of using a for loop) would still run the commands in serial, slowly, with the 20-ish second delay. With a reasonable number of workstations, the above command will start them all in parallel. There are of course other methods to running commands remotely, but this worked well for me.

Source: https://harryjohnston.wordpress.com/2009/12/18/delays-when-connecting-to-windows-7-clients-for-remote-administration/

Improve this answer
3
  • Thanks Jeff, great to hear someone else encountered the same challenge, I don't have an opportunity to test this at the moment but will try in future
    – GreyCloud
    Sep 28, 2016 at 20:34
  • On windows server 2016 i have to enable two rules: Remote Service Management (RPC) and Remote Service Management (RPC-EPMAP)
    – anilech
    Jul 5, 2017 at 8:44
  • After enabling 3 Remote Service Management rules, should also allow ports in AWS security group inbound rules, since the port is random, my rule is ports(1 - 65535) 10.0.0.0/16.
    – Teddy
    Jan 12, 2022 at 1:39
2

PSExec uses RPC, which uses a randomly allocated port; for modern Windows, that is in the 49152+ range.

IF you're using Windows Firewall, there's a built-in "Remote Service Management" rule that will allow those dynamic ports. There's also some registry tweaks to customize it, if you feel the need to.

Improve this answer
4
  • whats strange is that I have this rule enabled but still have the delay
    – GreyCloud
    Jan 25, 2016 at 8:56
  • for the fun of it I've enabled all inbound windows firewall rules in a group starting "Remote..." this has cut the delay to 15 seconds for the first command, subsequent commands are instant for around one minute then the delay is encountered again
    – GreyCloud
    Jan 25, 2016 at 8:58
  • Apparently (according to harryjohnston.wordpress.com/2009/12/18/…), the "Remote Service Management" built-in rule has an issue when deployed through Group Policy that it doesn't apply to services.exe. My answer below has the workaround, which is the run the command once locally. I'm sure you could make a custom rule to apply via Group Policy instead.
    – Jeff McJunkin
    Sep 28, 2016 at 13:34
  • I also noticed the same thing as GreyCloud. The delay is cut to 15 seconds on the first command, subsequent commands are very fast until the delay is encountered again after a minute or so. This only happens when firewall is enabled, file sharing is enabled, firewall exception for RPC is added for my IP address or general RPC exception is added. This is on Windows 10 system. When firewall is completely turned off, this does not happen. Does anybody see the same issue? Is there a fix?
    – Nitrous
    Mar 21, 2018 at 14:17
0

In Windows Firewall Remote Service Management is already predefined. Enable the 3 rules for PRIVATE and there is no delay.

Improve this answer
0

There must be three rules enabled:

Remote Service Management (NP-In)
Remote Service Management (RPC)
Remote Service Management (RPC-EPMAP)

More info here: https://serverfault.com/a/1100581/965884

Improve this answer
0

Here is all you need to allow PSExec to come in remotely. Run these on target PC, in this order. Tested on Win11 & WinSer22:

PowerShell - Admin:

Get-NetConnectionProfile | Set-NetConnectionProfile -NetworkCategory Private

CMD - Admin:

winrm qc -force
netsh AdvFirewall firewall add rule name=PSExec dir=In action=allow protocol=TCP localport=RPC profile=domain,private program=""%WinDir%\system32\services.exe"" service=any
netsh AdvFirewall firewall set rule group="Remote Service Management" new enable=yes

You may need to reboot for all changes to take effect.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.