Is it possible to run PsExec without admin$ share enabled on target PC?

Question

Long story short, I want to use PsExec to run ipconfig on a machine on our network using its IP. My cmd is open as admin, and I’m executing the PsExec command using the target machines local admin account. I keep getting “Make sure that the default admin$ share is enabled”.

Here’s what I’m running:
psexec -i \IP ipconfig /all -u .\username -p password

Am I able to run this command using the local admin account on the target machine, without having admin$ share enabled? I don’t believe this is a firewall issue, and the target machine is online and pinging.

I’ve already tried nslookup with the IP, doesn’t show hostname. If there’s another recommendation for getting an IP’s hostname, I’m open to using that instead.

Answer 1

No, as psexec evoke a cmd prompt remotly via psexecsvc.exe to run the command, thus need access to admin share for the first handshake.

To quote how it work;

How Does PsExec Work?

In the resources of the executable file PsExec.exe, there is another executable file – PSEXESVC, which is a Windows service file. When establishing a connection to a remote computer, the PsExec utility copies this file to the hidden administrative folder Admin$ of the remote computer (C:\Windows\System32\psexesvc.exe). In order for PsExec to connect to a remote computer, the LanmanServer and LanmanWorkstation services must be running on a computer. The SMB port (TCP/445) and UDP/137 ports should be opened on the firewalls between source and target computers.