0
1

I have no idea if this relates to any more executables aside from this one, but it has got me flustered. I am attempting to query the session ids and states on a remote pc via "paexec \\RemotePC query session". This works fine with psexec. When I attempt with paexec, I get the following:

Connecting to RemotePC...
Starting PAExec service on RemotePC...

Remote app failed to start.  Returned error:
  Failed to start "query" session. The system cannot find the file specified. [E
rr=0x2, 2]

PAExec returning exit code -9

I thought maybe it was a path problem, so I tried specifying the full path "c:\windows\system32\query.exe", using -w "c:\windows\system32\", and both. I wrote a batch script that called the executable with the same results (the batch file did run however). At a loss, I tried running it interactively on all known sessions on the remote machine (-i X), specifying different users from admins to guest and still no go. I triple checked that the executable was there. Any advice would be appreciated

asked 18 Oct '13, 01:33

mindchild's gravatar image

mindchild
1112
accept rate: 0%

edited 18 Oct '13, 01:35

Ok, some more information. I tried quser.exe with the same result. I thought I'd check in dependency walker (depends.exe) to see if there was something unusual about these executables, because cscript.exe works. I drag-and-dropped query.exe to the dependency walker window and lo' and behold, it said '"c:\windows\system32\query.exe" not found'. So I tried file->open and it isn't listed at all in file open browser (same with quser.exe). I tried renaming (copying and renaming) query.exe to querytest.exe and leaving it in c:\windows\system32\ and still can't be found.

(18 Oct '13, 13:31) mindchild

Continued:

I copied query.exe to a temp folder (c:\temp\query.exe) and tried and THAT worked. So SOMETHING about these files INSIDE c:\windows\system32\ is special. Something that psexec can handle, but paexec (and apparently dependency walker) can not

(18 Oct '13, 13:33) mindchild

Ok, another update. Apparently, a 32bit application trying to access c:\windows\system32\ on a 64bit system will redirect to c:\windows\syswow64\. Most of the applications in system32 have a counterpart in syswow64, which made this tedious to figure out. moving query.exe and quser.exe to syswow64 worked and confirmed this finding. So, I think the solution here is to disable file system redirection or replace %windir%\system32 with %windir%\sysnative

Hope this helps.

(18 Oct '13, 13:58) mindchild

Hi Mindchild

i confirm %windir%sysnativequers works with paexec

Great troubleshooting

link

answered 17 May, 09:40

AlwaysOnandOn's gravatar image

AlwaysOnandOn
1
accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×51
×2

Asked: 18 Oct '13, 01:33

Seen: 17,328 times

Last updated: 17 May, 09:40