4

I'm attempting to force a VM to log the current user out and send the session to the console via running a .bat script.

I can get this working if I manually run a .bat file on the VM which contains the following:

%windir%\System32\tscon.exe 0 /dest:console

However, when using psexec or paexec to call the same .bat:

c:\>psexec.exe \\virtualmachine -u domain\username -p password -h cmd /c
c:\user\atest\desktop\test.bat

I get an access denied:

Could not connect sessionID 0 to session name console, Error code 5 Error [5]:Access is denied. C:\windows\system32\tscon.exe exited on virtualmachine with error code 1.

Alternatively, I've tried (same result):

C:\>PsExec.exe \\virtualmachine -u domain\username -p password -h
C:\windows\system32\tscon.exe 0 /dest:console

I'm not sure where I'm going wrong, because this starts iexplore.exe fine:

C:\>PsExec.exe \\virtualmachine -u domain\username -p password -h "c:\program files\internet explorer\iexplore.exe"
adjuzy
  • 511
  • 2
  • 6
  • 22

4 Answers4

6

The problem was because the user was connected via RDP, it was not session 0. I had to run "query user" to get the session ID of the RDP connection, then pass that into PsExec using "-i" like so:

C:\>PsExec.exe -s -i $id \\virtualmachine c:\windows\system32\tscon.exe $id /dest:console

Because this is running as system (-s) I didn't need to pass in any authentication.

This answer helped me with the concept of sessions, hope it helps someone else.

Community
  • 1
  • 1
adjuzy
  • 511
  • 2
  • 6
  • 22
6

I had a batch file that worked for years ending a RDP session and leaving the host screen unlocked, it had conditions for sessionid's 0 through 10 just in case. Then this week after a windows update loaded it stopped working and I kept getting 7045 errors in the results of the batch file. The RDP session would close but the host machines screen was locked. The host machine runs a message board so this was not acceptable and the machine is mounted to the ceiling so no mouse or keyboard is possible.

I searched a ton and found nothing that worked more than once if it worked at all. Then I found this by chance, and when I ran this power shell command my problem was solved. It works great so far and better yet you don't have to know the sessionID or name, or pass a password in a text or batch file.

@powershell -NoProfile -ExecutionPolicy unrestricted -Command "$sessionid=((quser $env:USERNAME | select -Skip 1) -split '\s+')[2]; tscon $sessionid /dest:console" 2> UnlockErrors.log

Just copy the script into a text file, rename it something.cmd then create a shortcut to it on the hosts desktop and go to the properties and select advanced and have it run as administrator. Easy. Works on win7 pro. I found the script here https://steamcommunity.com/groups/homestream/discussions/0/617335934139051123/?ctp=5

Brian
  • 61
  • 1
  • 1
  • 1
    Thank you. This solution worked for me as well. Now I can get back to using Moonlight! – thepenguinmaster Nov 29 '18 at 01:37
  • 1
    Freaking brilliant! I love it when Christmas comes in February. – Newclique Feb 20 '19 at 01:10
  • Thank you! I used your answer as a reference to answer a similar question in another community. https://superuser.com/a/1718121/1679280 – Ash K Apr 26 '22 at 14:41
  • This was a great solution that i'd never imagine of. There is a software I need to use, it somehow understands RDP connections and doesnt let open on RDP. When I physically login, i can use the software flawlessly. With the code you shared, I force windows to log-in "physically" to itself :D and runt the exe. RDP connection drops and exe runs. Then i re-connect. Ta-da! – Berque Cemilian Jan 23 '23 at 15:26
1

I also faced the same issue with the following command Command – tscon SessionID /dest:console /password: ****

Resolution: I worked a lot and finally got to know the issue is with password. i.e. the password length should not be greater than 13 characters. But in this case password = 20 characters.

Later I changed the password to ****(12 characters) and issue got resolved.

user3815064
  • 21
  • 2
  • I ran into the same issue. I don't like that we need to reduce password length to use tscon. Really easy to brute force 13 character passwords on local windows accounts. – Alex May 03 '21 at 20:47
0

If you are not a local administrator of the VM, you won't be able to do this. The session I was logged-in with was not a local admin, but when running the shortcut "as an administrator", I tried using another account that was a local admin (when prompted). However, this doesn't work. The account you are moving to the console session is the one you are logged-in with, but if you use a different account for the shortcut elevation, TSCON will try using that account instead.

Kore Breach
  • 1