On Tue, Jul 18, 2017 at 9:13 AM, Michael B. Smith <[email protected]>
wrote:
> I always thought it was “klist purge –li 0x3e7”, but this isn’t something
> I do often. It may not matter.
>
I used 'klist -li 0x3e7 purge" interactively, and it works fine.
C:\SysinternalsSuite>klist -li 0x3e7 purge
Current LogonId is 0:0x3aace53f
Targeted LogonId is 0:0x3e7
Deleting all tickets:
Ticket(s) purged!
Anyway, does just a klist work, with no arguments? Does “klist –li 0x3e7” ?
>
Yep, works fine ..
C:\SysinternalsSuite>psexec \\dctrweb026 c:\windows\system32\klist.exe
PsExec v2.11 - Execute processes remotely
Copyright (C) 2001-2014 Mark Russinovich
Sysinternals - www.sysinternals.com
Current LogonId is 0:0xa23e334
Cached Tickets: (1)
#0> Client: leonem @ WRK.ADS.PHA.PHILA.GOV
Server: cifs/dctrweb026.wrk.ads.pha.phila.gov @
WRK.ADS.PHA.PHILA.GOV
KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
Ticket Flags 0x40a10000 -> forwardable renewable pre_authent
name_canonicalize
Start Time: 7/18/2017 9:22:15 (local)
End Time: 7/18/2017 19:11:00 (local)
Renew Time: 0
Session Key Type: AES-256-CTS-HMAC-SHA1-96
Cache Flags: 0x8 -> ASC
Kdc Called:
c:\windows\system32\klist.exe exited on dctrweb026 with error code 0.
>
>
> *From:* [email protected] [mailto:listsadmin@lists.
> myitforum.com] *On Behalf Of *Michael Leone
> *Sent:* Tuesday, July 18, 2017 9:02 AM
> *To:* [email protected]
> *Subject:* [NTSysADM] Running a command with parameters using PSEXEC
>
>
>
> OK, so I'm just stupid today (altho today isn't really any different than
> any other day ..)
>
>
>
> I want to run "klist -li 0x3e7 purge" on one of my servers, and I want to
> do it remotely. So I tried to fire up PSEXEC to do it, and I'm passing the
> arguments wrong, somehow.
>
>
>
> C:\SysinternalsSuite>psexec \\dctrweb026 c:\windows\system32\klist "-li
> 0x3e7 purge"
>
>
>
> PsExec v2.11 - Execute processes remotely
>
> Copyright (C) 2001-2014 Mark Russinovich
>
> Sysinternals - www.sysinternals.com
>
>
>
>
>
>
>
> Usage: klist.exe [command]
>
>
>
> Command list:
>
> [tickets] [-lh <LogonId.HighPart>] [-li <LogonId.LowPart>]
>
> tgt [-lh <LogonId.HighPart>] [-li <LogonId.LowPart>]
>
> purge [-lh <LogonId.HighPart>] [-li <LogonId.LowPart>]
>
> sessions [-lh <LogonId.HighPart>] [-li <LogonId.LowPart>]
>
> kcd_cache [-lh <LogonId.HighPart>] [-li <LogonId.LowPart>]
>
> get <SPN> [-lh <LogonId.HighPart>] [-li <LogonId.LowPart>]
>
> [-kdcoptions <options>]
>
> add_bind <DOMAIN> <DC>
>
> query_bind
>
> purge_bind
>
> c:\windows\system32\klist exited on dctrweb026 with error code -1.
>
>
>
>
>
> So what did I do wrong on the PSEXEC invocation? I gave it the machine to
> run on; the full path to the command I want executed; and the arguments for
> that command. That's what the help says to do.
>
>
>
> I obviously have rights to do it, but I'm not sending the parameters to
> klist correctly.
>
>
>
> It's got to be something simple, and I'll feel like a moron, once somebody
> points it out to me. But that won't be the first time ..
>
>
>
> Clues, anyone?
>
>
>
> (target is Win2012 R2, if it matters)
>
>
>
