Using CMDKEY in a PSEXEC batch file

[jgq...@gmail.com]

I am trying to apply CMDKEYto each of a number of Windows 7 Pro PCs
in a workgroup using PsExec in an Elevated/Run as Administrator
batch file run on an additional PC, using (on one line)

psexec \\%pc% -h cmd /c CMDKEY /ADD:targetpc /USER:username /PASS:password

and get

CMDKEY: Credentials cannot be saved from this logon session.

I've tried a number of variations on the PSEXEC parameters:
* using /l instead of /h
* omitting these parameters entirely
* omitting cmd /c
but I get the same error message.

Has anyone got this to work, or can someone tell me what's wrong?
If I run CMDKEY on any PC, it works correctly!

[foxidrive]

Minor googling - I don't know if it applies to you, the question mentions
XP and transplanting cmdkey, but it's possible this is not related to that
part:


Verified Answer

by:McKnifePosted on 2014-10-28 at 12:26:41ID: 40409237
There are GPOs that disallow credential saving, those seem to be active.
See
http://www.itworld.com/article/2779749/windows/how-to-disable-credential-caching-on-client-computers.html
Easily found out if you run rsop.msc at the client.


http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Windows/XP/Q_28546181.html

[jgq...@gmail.com]

Thank you - but I found that already, and couldn't believe that ENABLING a policy saying "Network Access: Do not allow storage of credentials or .NET Passports for network authentication" would be much use, when I actually wanted to STORE credentials!

I also made the point that "If I run CMDKEY on any PC, it works correctly" - meaning not using PSEXEC at all - so it seems unlikely that a GPO can be implicated.

[foxidrive]

On 6/09/2015 18:26, jgq...@gmail.com wrote:

>> There are GPOs that disallow credential saving, those seem to be
>> active.

> Thank you - but I found that already, and couldn't believe that ENABLING
> a policy saying "Network Access: Do not allow storage of credentials or
> .NET Passports for network authentication" would be much use, when I
> actually wanted to STORE credentials!

Your reading comprehension needs work. That sentence above is saying that
the setting may have been active.

[jgq...@gmail.com]

I've tried it with the setting enabled and the setting disabled, and get the same error message with both.

[jgq...@gmail.com]

Just to close this off, someone suggested that PsExec should be run with the /u and /p username and password parameters, even though these are the same on the target machine as on the source machine. When this is done, CMDKEY works as expected.

[ankitag...@gmail.com]

https://serverfault.com/a/971054/527108 you have to pass the session id of the local user with PsExec.