Issue with nested calls with psexec (access denied)

Question

Hello

First of all, sorry for my poor english. I would try to explain my problem.

I am using psexec within a script to restart a cluster as follows:

script1 in node1: perform a lot of tasks (shutdown services, check status, etc..) in the node1 and after completing all task launch with psexec the script2 in node2 (psexec-d \ \ node2 script2)

script2 in node2: perform a lot of tasks and launches script3 in node1. Here is, when i recived an "access denied" in psexec when I try to run the script3 in node1. (psexec-d \ \ nodo1 script3)

I launch the script with an user that belongs to the group administrators

For security reasons I can not pass username and password, because it is not safe to leave the credentials in a .bat file.

Additional info:

I´m running the script in W2k3 server I tried a net use and its all ok I tried a psexec with -u username and -p username and its all ok I tried to exec psexec with this syntax: psexec .exe -d \node1 cmd.exe "script3.bat" and returns the same error.

Thks a lot Best Regards

Answer 1

It may be related with an issue that one gets from too many linked server hops using integrated authentication - a double-hop Kerberos problem.

Since Integrated Windows Authentication covers two separate authentication mechanisms:

• NTLM v2 -and-
• Kerberos,

if you are using Kerberos, since the user's password is never passed to the IIS server, the only way the token on the IIS server is going to hop to another machine on the network is via Kerberos Delegation. If that isn't available or allowed, then the hop won't happen (which is what it sounds like is happening).

Given that you are using default credentials, and if the current security context is an impersonation token that can not delegate, then the credentials you supply will not hop to the other machine. Since Windows integrated authentication creates an impersonation token, this is very likely to be the case.

Sources:

• psexec problem
• Windows authentification thread (forum)

Answer 2

Thank you, we are stuck right now in this problem as we don't want to hardcode the credentials in the script, so we are thinking about making a synchronous batch or something like that.

Does anyone have any idea?

Answer 3

Can you make the call to script2 wait for completion, rather than have script2 call back to node1:

script1 in node1: perform a lot of tasks (shutdown services, check status, etc..) in the node1 and after completing all task launch with psexec the script2 in node2 (psexec \ \ node2 script2)

script2 in node2: perform a lot of tasks.

script1 in node1: launches script3.

Answer 4

Finally I have decided to use a watchdog process in the second script, so the script will be launched by this process instead of being launched by psexec.

Thanks a lot for your help and your time devoted to help me.

Best regards