# PSExec as a Helper in Troubleshooting

## What

Microsoft PsTools includes **PsExec**, a remote command-line tool that can help troubleshoot a Windows device when the FileWave Client is not responding through normal FileWave channels.

## When/Why

Use PsExec when you need an interactive command prompt on a Windows client to inspect services, logs, processes, network state, or user sessions. The examples below focus on FileWave Client troubleshooting, but the same approach is useful for other Windows service issues.

## How

<p class="callout info">**Assumptions for the examples below:**  
1) You downloaded PsTools and unzipped it.  
2) You launched Command Prompt as a domain admin or another account with the needed rights on the remote device.  
3) You changed into the directory where PsTools is located.</p>

Connect to the remote computer by name in an interactive PsExec shell:

```
psexec64 \\computername -h cmd
```

You should end up in a shell like the one below. Type `exit` to leave the remote shell.

[![Interactive PsExec command prompt on a remote Windows device](https://kb.filewave.com/uploads/images/gallery/2024-05/scaled-1680-/CwfTGWcpSghoTMos-image.png)](https://kb.filewave.com/uploads/images/gallery/2024-05/CwfTGWcpSghoTMos-image.png)

From that shell, you can run normal Windows command-line tools on the remote device. These examples are useful when a Windows client is not reporting correctly.

1. Check the FileWave Client service: 
    - ```
        sc query filewavewinclient
        ```
        
        [![Querying the FileWave Client service from PsExec](https://kb.filewave.com/uploads/images/gallery/2024-05/scaled-1680-/EFH8hn8CF60dOUD2-image.png)](https://kb.filewave.com/uploads/images/gallery/2024-05/EFH8hn8CF60dOUD2-image.png)
2. Stop the FileWave Client service: 
    - ---
        
        ```
        sc stop filewavewinclient
        ```
3. Start the FileWave Client service: 
    - ---
        
        ```
        sc start filewavewinclient
        ```
4. If the service will not start or stop, identify and stop the process directly: 
    1. Find the FileWave Client process. 
        - ```
            tasklist | findstr fwcld
            ```
        - [![Finding the fwcld process ID with tasklist](https://kb.filewave.com/uploads/images/gallery/2024-05/scaled-1680-/ahddHIXSHiUMjOuZ-image.png)](https://kb.filewave.com/uploads/images/gallery/2024-05/ahddHIXSHiUMjOuZ-image.png)
    2. Kill the process by PID. 
        - ```
            taskkill /PID 16264 /F
            ```
        - <p class="callout info">The same pattern can help with a stuck Windows Update agent. When Windows Update hangs and the service will not stop, `tasklist /svc | findstr wuauserv` identifies the process that owns the service. A reboot can also clear the condition, but it interrupts whoever is using the device.</p>
5. Check the FileWave Client log for entries from today: 
    - ```
        type c:\programdata\filewave\fwclient\fwcld.log | findstr mm-dd
        ```
    - Replace `mm-dd` with today's month and day, such as `05-16`.
6. Get the IP address of the workstation: 
    - ```
        ipconfig
        ```
7. Restart the device immediately. This interrupts any active user session, so check before running it on a device in use. 
    - ```
        shutdown -r -t 0 -f
        ```
8. Check whether other users are logged in: 
    - ```
        quser
        ```
    - [![Checking logged-in users with quser](https://kb.filewave.com/uploads/images/gallery/2024-05/scaled-1680-/fbQGBi4UEdXl5b3a-image.png)](https://kb.filewave.com/uploads/images/gallery/2024-05/fbQGBi4UEdXl5b3a-image.png)
9. Get the last boot time: 
    - ```powershell
        Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object LastBootUpTime
        ```
    - [![Getting the last Windows boot time with PowerShell](https://kb.filewave.com/uploads/images/gallery/2024-05/scaled-1680-/elLO7EOAz4KuwdN1-image.png)](https://kb.filewave.com/uploads/images/gallery/2024-05/elLO7EOAz4KuwdN1-image.png)

## Related Content

- [PS Tools](https://learn.microsoft.com/en-us/sysinternals/downloads/pstools)
- [Windows command-line reference (SS64)](https://ss64.com/nt/)
- [wmic deprecation](https://techcommunity.microsoft.com/blog/windows-itpro-blog/wmi-command-line-wmic-utility-deprecation-next-steps/4039242)