ConfigMgr Package: How to Run PsExec—and Why You Usually Shouldn’t

PsExec is usually unnecessary in a classic Microsoft Configuration Manager (ConfigMgr) Package/Program. When a program is configured to run whether or not a user is logged on, ConfigMgr normally launches it in the local computer’s SYSTEM context. Call PowerShell or the target executable directly, then use PsExec mainly to reproduce SYSTEM behavior during troubleshooting.

If PsExec is genuinely required, run it synchronously with -s; avoid -d unless you deliberately want the child process to outlive the ConfigMgr program.

#	Preview	Product	Price
1		UNIX and Linux System Administration Handbook	$60.51	Buy on Amazon
2		Unix System Administration Handbook	$13.89	Buy on Amazon
3		UNIX and Linux System Administration Handbook, 4th Edition	$22.25	Buy on Amazon
4		The Health Care Handbook: A Clear and Concise Guide to the United States Health Care System	$32.90	Buy on Amazon
5		Pilot's Handbook of Aeronautical Knowledge: FAA-H-8083-25C	$10.82	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

What “PsExec in a ConfigMgr package” actually means

Administrators often place PsExec.exe beside a PowerShell script and expect the package to use PsExec to obtain administrative rights. That combines three separate scenarios:

• Normal package execution: ConfigMgr launches the script or executable directly, commonly as SYSTEM.
• PsExec as a launcher: PsExec starts another process with options such as -s.
• PsExec diagnostics: An administrator opens a SYSTEM command prompt to reproduce the machine context outside the ConfigMgr client.

For local machine remediation, the first option is normally the correct one. The original discussion that prompted this topic reached the same conclusion: PsExec was not needed merely to run a ConfigMgr deployment as SYSTEM. The remaining problems were execution architecture and a service that prevented the requested Defender-related changes. See the original ConfigMgr discussion.

#1 Best Overall

UNIX and Linux System Administration Handbook

$60.51

Buy on Amazon

Preferred setup: call PowerShell directly

A simple package source might contain:

\SourceServerPackagesDefender-Remediation
    Deploy.ps1
    Logging.ps1
    README.txt

Use a stable, versioned source directory and keep every dependency with the script. In the Package/Program command-line field, use a command such as:

%windir%SysNativeWindowsPowerShellv1.0powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File .Deploy.ps1

SysNative exposes native 64-bit Windows binaries when the parent process is 32-bit on a 64-bit operating system. If the invoking process is already 64-bit, use %windir%System32 instead. Do not treat SysNative as universally correct; log the actual process architecture.

Configure the program for a silent machine deployment:

• Run whether or not a user is logged on.
• Run with administrative rights where that option is available.
• Keep the program hidden and disable user interaction for a noninteractive remediation.
• Set realistic estimated and maximum run times.
• Test with a small device collection before production deployment.

Traditional package command lines have a documented 127-character limit in package-definition-file syntax. Put complex settings in a configuration file or use a short wrapper rather than constructing an oversized command line. Microsoft’s package documentation covers command-line and working-directory behavior.

Rank #2

Sale

Unix System Administration Handbook

$13.89

Buy on Amazon

Make paths independent of the ConfigMgr working directory

A package should not assume that its current directory is C:WindowsSystem32, the user profile, or a mapped drive. PowerShell’s $PSScriptRoot points to the directory containing the script:

$ErrorActionPreference = 'Stop'

$SourceRoot = $PSScriptRoot
$LogDirectory = Join-Path $env:ProgramData 'ContosoLogs'
$LogFile = Join-Path $LogDirectory 'Defender-Remediation.log'

New-Item -Path $LogDirectory -ItemType Directory -Force | Out-Null

Use absolute paths for operating-system resources and $PSScriptRoot for files shipped in the package. SYSTEM also does not receive the logged-on administrator’s network credentials; access to a share may require computer-account permissions or local content.

Use PsExec to test SYSTEM—not automatically to deploy

From an elevated administrative command prompt, a useful local diagnostic is:

PsExec64.exe -accepteula -i -s cmd.exe

Then verify the identity and environment:

whoami
echo %PROCESSOR_ARCHITECTURE%
where powershell.exe

The expected identity is:

nt authoritysystem

From that shell, run the script synchronously and inspect its own log. This test reproduces the account context, but not every ConfigMgr condition: it does not reproduce content staging, client timeouts, execution-manager behavior, or application detection.

Rank #3

Sale

UNIX and Linux System Administration Handbook, 4th Edition

• New
• Mint Condition
• Dispatch same day for order received before 12 noon
• Guaranteed packaging
• No quibbles returns

$22.25

Buy on Amazon

The PsExec switches have distinct purposes. Microsoft documents -s for the SYSTEM account, -i for attaching to an interactive desktop session, and -d for not waiting for the process to terminate. See Microsoft’s PsExec documentation. Interactive mode is generally inappropriate for a silent deployment because there may be no suitable user session.

If PsExec is genuinely required

Include an approved copy of the binary in the package source and use a relative path. A synchronous command can look like this:

.sExec64.exe -accepteula -s "%windir%SysNativeWindowsPowerShellv1.0powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File ".Deploy.ps1"

When quoting becomes difficult, use a batch wrapper:

@echo off
setlocal
set "LOG=%ProgramData%ContosoLogsPsExec-wrapper.log"
if not exist "%ProgramData%ContosoLogs" mkdir "%ProgramData%ContosoLogs"

.sExec64.exe -accepteula -s "%windir%SysNativeWindowsPowerShellv1.0powershell.exe" ^
  -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass ^
  -File "%~dp0Deploy.ps1"

set "RC=%ERRORLEVEL%"
echo Exit code %RC%>> "%LOG%"
exit /b %RC%

Do not add -d to a ConfigMgr program unless asynchronous execution is intentional and separately monitored. With -d, PsExec can return before PowerShell finishes, causing ConfigMgr to report success while the remediation later fails.

Rank #4

Sale

The Health Care Handbook: A Clear and Concise Guide to the United States Health Care System

$32.90

Buy on Amazon

PsExec is a legitimate Microsoft Sysinternals utility, but it is also commonly abused. Antivirus and EDR products may flag it, quarantine it, or block its service behavior. Validate the binary through your organization’s software-supply-chain and malware controls; do not assume a security exclusion is required or safe.

Confirm identity, architecture, and paths before changing anything

Place diagnostics at the beginning of the script:

$identity = [Security.Principal.WindowsIdentity]::GetCurrent().Name
$is64BitOS = [Environment]::Is64BitOperatingSystem
$is64BitProcess = [Environment]::Is64BitProcess
$psVersion = $PSVersionTable.PSVersion.ToString()

@(
  "Time: $(Get-Date -Format o)"
  "Identity: $identity"
  "64-bit OS: $is64BitOS"
  "64-bit process: $is64BitProcess"
  "PowerShell: $psVersion"
  "PSScriptRoot: $PSScriptRoot"
  "Current directory: $(Get-Location)"
) | Out-File -FilePath $LogFile -Encoding utf8 -Append

This distinguishes a real PsExec problem from a wrong account, a 32-bit process, an unexpected package path, unavailable network content, or an asynchronous child process.

Registry view matters

On 64-bit Windows, a 32-bit process can see the redirected 32-bit registry view. A script that reads or changes HKLMSoftware may therefore touch a different view from Registry Editor running in a 64-bit administrator session.

Check:

[Environment]::Is64BitOperatingSystem
[Environment]::Is64BitProcess

For .NET registry operations, select the required view explicitly when the product documentation calls for it:

Best Value

Sale

Pilot's Handbook of Aeronautical Knowledge: FAA-H-8083-25C

$10.82

Buy on Amazon

$baseKey = [Microsoft.Win32.RegistryKey]::OpenBaseKey(
  [Microsoft.Win32.RegistryHive]::LocalMachine,
  [Microsoft.Win32.RegistryView]::Registry64
)

Do not broadly claim that “ConfigMgr packages run in x86 mode.” Architecture depends on the particular launcher, deployment type, and settings. The x86 controls exposed in some task-sequence and application operations do not constitute a universal Package/Program setting. Review task-sequence execution and WOW64 behavior, along with Microsoft’s documentation for application installation architecture and deployment-type controls.

A service lock is a separate remediation problem

If a script launches successfully but cannot delete, replace, or modify the target Defender files or registry values, PsExec may not be the cause. A service, tamper-protection feature, file lock, or product self-healing mechanism may intentionally prevent the operation.

Before changing service configuration, establish:

• Which service owns or protects the resource.
• Whether Microsoft supports stopping, disabling, or modifying it.
• Whether tamper protection or current Defender controls intentionally block the action.
• Whether a reboot, maintenance mode, recovery environment, or supported onboarding-repair procedure is required.
• Whether the original remediation remains appropriate for the current Windows build and Defender for Endpoint agent.

Do not add broad Defender exclusions simply to force a destructive script or PsExec to run. Any exception should be narrowly scoped, time-limited, approved, and based on current product guidance.

Capture errors and return meaningful exit codes

Logging only the launcher’s success is insufficient. Critical operations should stop on failure and record the actual exception:

$ErrorActionPreference = 'Stop'

try {
    # Critical operation
}
catch {
    $_ | Out-String | Out-File -FilePath $LogFile -Append
    exit 1
}

An exit code of zero proves only that the process completed according to its own logic. Validate the intended file, registry value, service state, and final product health, and return a failure code when those checks fail.

Troubleshooting order

1. Confirm the account with WindowsIdentity.
2. Confirm 32-bit or 64-bit process architecture.
3. Log $PSScriptRoot and the current directory.
4. Check SYSTEM’s access to network resources.
5. Check service state, file locks, tamper protection, and EDR events.
6. Confirm the registry view and exact target path.
7. Check whether PsExec used -d or otherwise launched a child asynchronously.
8. Check the configured program timeout.
9. Inspect the deployment-specific ConfigMgr log.
10. Read the script’s exit code and post-action validation.

For classic Package/Program execution, inspect ExecMgr.log. For application enforcement, use AppEnforce.log. For content acquisition, use CAS.log and ContentTransferManager.log; for content-location issues, use LocationServices.log. Task sequences write to smsts.log. CMTrace can display these logs, but it is a log viewer—not a general distribution-point health test.

Choose the right ConfigMgr mechanism

Bottom line

For a ConfigMgr Package/Program, start by removing PsExec and invoking the script directly. Configure the program for the intended machine context, use explicit paths, verify 64-bit behavior, log identity and architecture, and return the script’s real result. Keep PsExec for controlled SYSTEM-context diagnostics or for a documented requirement that cannot be met by ConfigMgr itself.

Quick Recap

Bestseller No. 1

UNIX and Linux System Administration Handbook

$60.51

SaleBestseller No. 2

Unix System Administration Handbook

$13.89

SaleBestseller No. 3

UNIX and Linux System Administration Handbook, 4th Edition

New; Mint Condition; Dispatch same day for order received before 12 noon; Guaranteed packaging

$22.25

SaleBestseller No. 4

The Health Care Handbook: A Clear and Concise Guide to the United States Health Care System

$32.90

SaleBestseller No. 5

Pilot's Handbook of Aeronautical Knowledge: FAA-H-8083-25C

$10.82

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.