PSexec tool is giving error : communicating with PsExec service on "Hostname": No process is on the other end of the pipe.

In the other post, Azar has answered and suggested a script, to be run as "SYSTEM" from Task schedular, which removes files if it crosses a certain size, I have tried and also used variables of Date instead of size, to delete the files,despite setting it up on TaskSchedular for running everyday, it doesn't delete all the files, it runs everyday in my system, and only deletes 5-10% of the files, which are System owned, rest all files are owned by "TrustedInstaller", those are never getting deleted.
Fo rthe PSexec tool, I have tried them all, I have first deleted the psexesvc then I have remove the registry, checked the service was also gone, then I ran the "psexec -sid cmd" command, I have checked the registry again was built and the service appeared again. But still giving the same error.

Two points...

Run using the -s switch, not -sid. "D" says to run the program non-interactively, and "I" says to interact with the desktop. If you have RDP'd to the server, then you have not logged on to the console. I would think that that is your problem.

     -d         Don't wait for process to terminate (non-interactive).
     -i         Run the program so that it interacts with the desktop of the
                specified session on the remote system. If no session is
                specified the process runs in the console session.

-sid causes a separate window to launch.

While -s uses the existing cmd window.

Point 2.

Look at the script that I posted. It does a try/catch and if the initial delete fails, it does a takeown on the file and tries again.

If running it with "run as administrator" fails, then use a scheduled task that runs as the system account. Run it and then examine the transcript log file to see what it did.

Hi @MotoX80
I have tried them now.

1. Logged into console and tried with -s and -sid both, getting same error.
2. Logged in with Default domain admin and local admin, tried both the command, same error.

3.Tried the script with task schedular, which you have given, though I have tried the "Takeown" command before as well, again tested this, I got the sysmon log file saved, but nothing was deleted, the size remained same. (only 1 file got deleted as my previsous script ran already few hours back).

All

Thank You for taking up this as challenge, but I don't see what's wrong with it, while my I am able to delete using PSexec in my Lab environment, but not any of the actual servers.
Let me know if there is any alternative is there.

I have no idea what psexec is doing on your servers.

Given that psexec would be a one time manual process, I recommend that you focus on the script+task since that would be an automated process that you can define once and then just let it run every week or so.

Please share the contents of the C:\YourFavoriteLogFolder\SysmonPurge.log file. (Wherever you put it.)

Remove the bulk of any redundant lines (if there are any) that just show the same thing over and over.

Start-Transcript -Path C:\YourFavoriteLogFolder\SysmonPurge.log
$keep = 7                 # keep files that have been created in the last nnn days
"Permissions for the Sysmon folder"
icacls.exe C:\sysmon
$files = Get-ChildItem -Path C:\sysmon -file 
"Starting file count is {0}" -f $files.count
foreach ($f in $files) { 
    if ($f.LastWriteTime -lt ((Get-Date).AddDays(-$keep)))  {     # or use CreationTime
        "{0} - {1}" -f   $f.LastWriteTime, $F.fullname            # or use CreationTime     
        try {
            $f | remove-item -force -ErrorAction stop -whatif
        } catch {
            "Take ownership and try again."
            takeown.exe /f $f.fullname
            $f | remove-item -force -whatif 
        }
    } else {
        "Keeping {0}" -f $f.fullname
    } 
}
$files = Get-ChildItem -Path C:\sysmon -file 
"Ending file count is {0}" -f $files.count
Stop-Transcript 

As I commented in the prior question, the -whatif switch will block the delete from actually occurring. The intent is to not delete any files until you determine if you want to use the LastWriteTime or CreationTime as the criteria for deleting the file.

Hi @MotoX80

I have tried this script too by removing the -whatif switch.

The folder size reduced only few MBs which is the usual with my early script.

I am pasting the output for a sample failed deletion file below.

Windows PowerShell transcript start

Start time: 20241205160005

Username: TEST\SYSTEM

RunAs User: TEST\SYSTEM

Configuration Name:

Machine: <Hostname> (Microsoft Windows NT 10.0.17763.0)

Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\TEMP\LimitSysmon.ps1

Process ID: 14472

PSVersion: 5.1.17763.6530

PSEdition: Desktop

PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17763.6530

BuildVersion: 10.0.17763.6530

CLRVersion: 4.0.30319.42000

WSManStackVersion: 3.0

PSRemotingProtocolVersion: 2.3

SerializationVersion: 1.1.0.1

Transcript started, output file is C:\YourFavoriteLogFolder\SysmonPurge.log

Permissions for the Sysmon folder

C:\sysmon NT AUTHORITY\SYSTEM:(OI)(CI)(F)

      Mandatory Label\System Mandatory Level:(NW,NR,NX)

Successfully processed 1 files; Failed processing 0 files

Starting file count is 10399

remove-item : Cannot remove item C:\sysmon\000A72678CB6055092AD5F6AB52E4A909742E991D63395128E71763CD0806D6CE05C3CF5C9D1

33DCD40532149A2AC8173F6332FDA4379B51A7903F3431EA9D2A39D2847700000000000000000000000000000000.js: Access to the path is

denied.

At C:\TEMP\LimitSysmon.ps1:15 char:18

•         $f | remove-item -force  # Remove the file ...
  

•              ~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidArgument: (C:\sysmon\000A7...000000000000.js:FileInfo) [Remove-Item], ArgumentExc
  eption
  • FullyQualifiedErrorId : RemoveFileSystemItemArgumentError,Microsoft.PowerShell.Commands.RemoveItemCommand

6/16/2023 4:53:05 PM - C:\sysmon\00106206C3DBF49ADB762335C6D83A65D0F84B89D8FE65601370ADC865432BCBEC215B727A940CA9E11519FF7A4946947A656E8E82FCDFA326AD3CEE5862BFE8ECF73A8046E2A7F308D993E2AB48584E557A028B.001b

TerminatingError(Remove-Item): "The running command stopped because the preference variable "ErrorActionPreference" or common parameter is set to Stop: Cannot remove item C:\sysmon\00106206C3DBF49ADB762335C6D83A65D0F84B89D8FE65601370ADC865432BCBEC215B727A940CA9E11519FF7A4946947A656E8E82FCDFA326AD3CEE5862BFE8ECF73A8046E2A7F308D993E2AB48584E557A028B.001b: Access to the path is denied."

Take ownership and try again.