N
N
Nordman992022-01-19 16:57:59
PowerShell
Nordman99, 2022-01-19 16:57:59

How to start a remote powershell or psexec session on a computer in safe mode?

Good day everyone, tell me about the problem:
There is a need to service a number of computers in the domain, usually I do this remotely in the powershell using different methods - invoke-command, enter-pssession, and so on. There are many options for performing remote operations.
But then it became necessary to carry out a number of operations in a safe mode, because. there is a safe mode with loading network drivers, then I thought to try to remotely reboot the desired computer into this mode and then work with the computer further, but the WinRM service does not work in safe mode, it, in turn, depends on the services:
Dcomlaunch, Rpcss, RpcEptMapper , and the Http network driver
By analogy with the article https://winitpro.ru/index.php/2014/02/05/zapusk-sl...
I added these services to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network section
. http - the driver was added with the only difference that the services have the parameter - Service and the drivers - Driver
So I rebooted the required computer in safe mode with network drivers, I check -
net start service name - Dcomlaunch, Rpcss, RpcEptMapper - work, and the http driver is like this and does not start
net start http gives out: The driver was not loaded, because. the system is running in safe mode,
although I created the KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Http section and the parameter in it is Driver (just in case, I tried Service, rebooted - the same)
Accordingly, the WinRM service also does not start without http drivers
What to do? How to run http?
The ability to launch a remote session through psexec will do just fine. he also does not want to connect to the computer in safe mode - he writes he does not see the admin $ sphere and it is not at all clear what services Psexec depends on

Answer the question

In order to leave comments, you need to log in

1 answer(s)
N
Nikolai Turnaviotov, 2022-02-02
@foxmuldercp

 Protected mode - that's why it's protected. You better describe what you want to do in order to understand that there are likely other tools

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question