Knowledge Base

PsExec Overview

PsExec is a light-weight program that allows you to execute processes on a remote computer. The program allows you to access the command-prompt of the remote computer. With PsExec you can start uLog on one computer with The Observer XT on another computer. PsExec is part of the PsTools suite from Microsoft Corporation. For a complete overview go to http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx.

Installation

To install PsExec, go to http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx and click Download PsTools. Locate the downloaded zip folder with Windows Explorer and open it. Double-click PsExec and choose Extract all. Browse to the location where you want to store the executable and click Extract. The program is copied to the specified location on your computer.

Registry Entry

To ensure you connect to the remote computer as a full administrator, you must add a key to the registry of both computers. To do so:

Windows 10 + Windows 11 — Type registry editor in the Windows search field, right-click on Registry Editor and run it as administrator.

1. Open the registry editor and browse to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.
2. Right-click in the right field and select New and then DWORD (32-bit) Value.
3. Name the registry entry LocalAccountTokenFilterPolicy.
4. Right-click the entry and select Modify. In the Edit DWORD (32-bit) Value window that appears, enter 1 in the field under Value data.
5. Click OK and close all windows.

More information about this registry entry can be found at http://support.microsoft.com/kb/951016.

Firewall

Some anti-virus scanners report that one or more of the tools are infected with a "remote admin" virus. None of the PsTools contain viruses, but they have been used by viruses, which is why they trigger virus notifications. You may need to create an exception for PsExec in the firewall or virus scanner of both computers. The procedure to create an exception in Windows Firewall is described below. If you have another firewall, consult its manual for the correct procedure.

1. Open the Control Panel and click Windows Defender Firewall.
2. Click Allow a program or feature through Windows Defender Firewall.
3. Click Change Settings at the top of the page.

On the computer with PsExec:

4. Click Allow another app, browse to PsExec.exe and click Add.
5. Select all check boxes next to Execute processes remotely. Then click OK and close the Control Panel.

On the computer with The Observer XT:

6. Select all check boxes next to Remote Service Management. Then close the Control Panel.

If PsExec still does not work properly, you may disable the firewall or anti-virus scanner completely on the remote computer during the time PsExec is used. The procedure to disable Windows Defender Firewall is described below. If you have another firewall or virus scanning application, consult its manual for information on how to disable it.

1. Open the Control Panel and open Windows Defender Firewall.
2. Click Turn Windows Defender Firewall on or off.
3. Select Turn off Windows Defender Firewall (not recommended) for all networks.

User Account Control Settings

If PsExec does not work, although you followed the procedure above and disabled the firewall, adjust the User Account Control Settings. To do so:

1. Open the Control Panel and click User Accounts.
2. Click Change User Account Control settings.
3. Move the slider completely towards Never notify.
4. Click OK and close the Control Panel. Now restart the computer.

Remember to turn the Firewall on again after you have finished working with PsExec.

User Account

If PsExec still does not work, although you followed all the steps above, let your system administrator create a new user account with administrator rights on the computer with uLog. Log on with this new user account.

Settings in The Observer XT

1. Open The Observer XT.
2. In The Observer XT, choose Setup > Project Setup.
3. Under Observation source, select Live Observation. The Devices window opens. If not, click the Devices button.
4. Click the Add external program button. In the Add External Program window that opens:
   • In the field next to Name, type a name for the commands (for viewing purposes only), for example, Control uLog.
   • Select the check box next to New Observation. In the same row, browse to PsExec.exe and type the following command in the field under Command line options:
     -u user name remote PC -p password remote PC \\remote PC name -i 1 -d "location uLog.exe"
   • Select the check box next to Start Observation. In the same row, browse to PsExec.exe and type the following command in the field under Command line options:
     -u user name remote PC -p password remote PC \\remote PC name -i 1 -d "location uLog.exe" /R
     Enter the delay to start uLog in the field next to ms, before.
   • Select the check box next to Stop Observation. In the same row, browse to PsExec.exe and type the following command in the field under Command line options:
     -u user name remote PC -p password remote PC \\remote PC name -i 1 -d "location uLog.exe" /S
     Enter the delay to stop uLog in the field next to ms, before.
5. Click OK. A new row Control uLog appears in the Devices window. You can now start observing in The Observer XT. uLog opens when you create a new observation, and logging starts and stops when you start and stop an observation.
6. Import the log file into the observation. If you set the delay correctly in the ms. before fields of the Add External Program window, the uLog events are synchronized with the manually scored events of The Observer XT.

Note: "location uLog.exe" is the path to the program file uLog.exe. This path depends on the folder in which you installed uLog and can be, for example, C:\Program Files (x86)\ulog\ulog.exe.

Source: EthoVision XT 18 - THC - Trial and Hardware Control, Noldus Information Technology