Replace PsExec by open source alternatives

[Iey4iej3]

Including such a closed source component seems to be a bad idea. I would propose to replace it by open source alternatives. I am not sure whether https://github.com/poweradminllc/PAExec serves.

[tsgrgo]

Thank you for the proposal! I've tried PAExec, but it didn't seem to work. But also, I'd rather have a Microsoft signed binary if I need to include one. Even with that, their machine learning algorithm has been false flagging the repo as malware every time I make any change.

I've been trying to get this to work with a scheduled task only, which would eliminate the need for PsExec:

TLDR: I have the updated scripts on this branch for testing: https://github.com/tsgrgo/windows-update-disabler/tree/Remove-PsExec

Explanation:

The schtasks /Create command has a /ru parameter, which lets you create and run a task with permissions of the local System account.

So basically, a temporary task could be created and started to run the rest of the batch file with system privileges, and then could be deleted with something like this:

if not "%1"=="admin" (powershell start -verb runas '%0' admin & exit /b)
if not "%2"=="system" (
	schtasks /Create /tn TempTask /tr "'%~f0' admin system" /sc ONCE /st 00:00 /rl HIGHEST /f /ru SYSTEM
	schtasks /Run /tn TempTask 
	schtasks /Delete /tn TempTask /f
	exit /b
)

Since system tasks run in the isolated Session 0, which is not interactive, the task won't open a cmd window. It just executes the batch file in the background silently. I couldn't find a solution for this (other than the workaround I describe next). With PsExec we could run code remotely in Session 0 from the user's session, which solved this issue.

What I came up with is to pipe the output of the batch file (started by the task) into a file in %temp%. So the scheduled task would be created like this:

schtasks /Create /tn TempTask  /tr "'%~f0' admin system > '%temp%\temp.log'" /sc ONCE /st 00:00 /rl HIGHEST /f /ru SYSTEM

This will write all output to %temp%\temp.log, which can be continuously read and displayed in the original command prompt with powershell's Get-Content '%temp%\temp.log' -Wait.

Then, after the script executed (+ after a short delay to make sure every line could be read by the powershell in the user's session) we can delete the file in %temp%. This signals the user session cmd that the script has finished executing (the Get-Content silently fails, and pause && exit /b is executed):

if not "%1"=="admin" (powershell start -verb runas '%0' admin & exit /b)
if not "%2"=="system" (
	schtasks /Create /tn TempTask  /tr "'%~f0' admin system > '%temp%\temp.log' && timeout /t 1 && del '%temp%\temp.log'" /sc ONCE /st 00:00 /rl HIGHEST /f /ru SYSTEM
	schtasks /Run /tn TempTask
	schtasks /Delete /tn TempTask /f
	powershell -NoProfile -Command "Get-Content '%temp%\temp.log' -Wait -ErrorAction SilentlyContinue"
	pause && exit /b
)

One issue remaining is that the value for the '/tr' option cannot be more than 261 characters. If we were to run the batch file from a really long path, this would cause an exception. I was able to solve this by creating a temporary batch file with the previous task's script, and invoke this batch file from the task instead. (Also fixed the encoding issue with -Encoding oem , and generate the names dynamically to avoid possible name collisions)

if not "%1"=="admin" (powershell start -verb runas '%0' admin & exit /b)
if not "%2"=="system" (
	echo "%~f0" admin system ^> "%temp%\%~nx0.log" ^& timeout /t 1 ^& del "%temp%\%~nx0.log" "%temp%\%~nx0" > "%temp%\%~nx0"

  	schtasks /Create /tn "%~nx0" /tr "'%temp%\%~nx0'" /sc ONCE /st 00:00 /rl HIGHEST /f /ru SYSTEM
	schtasks /Run /tn "%~nx0"
	schtasks /Delete /tn "%~nx0" /f

	powershell -NoProfile -Command "Get-Content '%temp%\%~nx0.log' -Wait -Encoding oem -ErrorAction SilentlyContinue"
	pause && exit /b
)

Another issue is that the task won't run if on battery (not plugged in), which is quite a significant concern. When started with schtasks /Run the task will just be stuck on queued state until the laptop is plugged in. Unfortunately these options cannot be configured with schtasks . We need to export the created task to an xml file, edit the content to allow on battery, then use the patched xml to create a new task:

if not "%1"=="admin" (powershell start -verb runas '%0' admin & exit /b)
if not "%2"=="system" (
	echo "%~f0" admin system ^> "%temp%\%~nx0.log" ^& timeout /t 1 ^& del "%temp%\%~nx0.log" "%temp%\%~nx0" > "%temp%\%~nx0"

	schtasks /Create /tn "%~nx0" /tr "'%temp%\%~nx0' && schtasks /Delete /tn '%~nx0' /f" /sc ONCE /st 00:00 /rl HIGHEST /f /ru SYSTEM
	schtasks /query /tn "%~nx0" /xml > "%temp%\%~nx0.xml"
	powershell -NoProfile -Command "(Get-Content '%temp%\%~nx0.xml') -replace 'OnBatteries>true', 'OnBatteries>false' | Set-Content '%temp%\%~nx0.xml'"
	schtasks /delete /tn "%~nx0" /f
	schtasks /create /tn "%~nx0" /xml "%temp%\%~nx0.xml" /f 
	del "%temp%\%~nx0.xml"
	schtasks /Run /tn "%~nx0"
	
	powershell -NoProfile -Command "Get-Content '%temp%\%~nx0.log' -Wait -Encoding oem -ErrorAction SilentlyContinue"
	pause && exit /b
)

Quite a big hustle, but this works very nicely. However, the task still won't run if we are in battery saver mode... Bummer! According to Microsoft, in battery saver mode, tasks only run when:

set to run only when user is logged on (task LogonType is TASK_LOGON_INTERACTIVE_TOKEN or TASK_LOGON_GROUP)
https://learn.microsoft.com/en-us/windows-hardware/design/component-guidelines/battery-saver

But I don't think this is possible with a System task. Maybe the battery saver mode could be temporarily disabled by setting the active power scheme to High performance with the following command:

powercfg /setactive SCHEME_MIN

The script would look something like this. It will also restore the previous power plan once finished.

setlocal enabledelayedexpansion

if not "%1"=="admin" (powershell start -verb runas '%0' admin & exit /b)
if not "%2"=="system" (
	echo "%~f0" admin system ^> "%temp%\%~nx0.log" ^& timeout /t 1 ^& del "%temp%\%~nx0.log" "%temp%\%~nx0" > "%temp%\%~nx0"
	
	for /f "tokens=4" %%i in ('powercfg /getactivescheme') do set CURRENT=%%i
	powercfg /setactive SCHEME_MIN
	
	schtasks /Create /tn "%~nx0" /tr "'%temp%\%~nx0' && schtasks /Delete /tn '%~nx0' /f" /sc ONCE /st 00:00 /rl HIGHEST /f /ru SYSTEM
	schtasks /query /tn "%~nx0" /xml > "%temp%\%~nx0.xml"
	powershell -NoProfile -Command "(Get-Content '%temp%\%~nx0.xml') -replace 'OnBatteries>true', 'OnBatteries>false' | Set-Content '%temp%\%~nx0.xml'"
	schtasks /delete /tn "%~nx0" /f
	schtasks /create /tn "%~nx0" /xml "%temp%\%~nx0.xml" /f 
	del "%temp%\%~nx0.xml"
	schtasks /Run /tn "%~nx0"
	
	powershell -NoProfile -Command "Get-Content '%temp%\%~nx0.log' -Wait -Encoding oem -ErrorAction SilentlyContinue"

	powercfg /setactive !CURRENT!
	pause && exit /b
)

This works fine if the user hasn't changed the settings for the high performance plan. It could be restored with powercfg /restoreindividualdefaultscheme scheme_min, but that removes the user's settings, which might be destructive.

Final note

This is how far I've currently gotten, there might be other issues I haven't discovered yet that would cause this solution to be unstable.

At this point, with such high complexity, I think it is worth considering whether this is better than the original one-liner with a Microsoft signed executable, which is known to be very stable. Also, as I've mentioned before, the repo already gets falsely flagged as malware quite often (even if only for short periods, until a human review). I'm not sure how such a solution would go.