Skip to main content

Test PowerShell as SYSTEM with PsExec on Windows

What

FileWave runs Windows deployment scripts as the local SYSTEM account. Microsoft PsExec lets you test a PowerShell script in that same security context before deploying it through a Fileset or Custom Field.

When/Why

Current FileWave Windows clients are 64-bit. Test with 64-bit PowerShell unless you are reproducing a legacy 32-bit execution path. For script-based Custom Fields, the On Windows, run as 64-bit setting controls the PowerShell architecture. Testing as SYSTEM catches differences in permissions, profile paths, mapped drives, registry hives, and user-specific environment variables.

How

Use a trusted script on a test device where its changes are acceptable. Running it as SYSTEM executes it with powerful local privileges; this is not a dry run. Review the script and its arguments before starting it.

  1. Download PsExec from the Sysinternals Suite (https://docs.microsoft.com/en-us/sysinternals/downloads/psexec )

  2. Open a native 64-bit Command Prompt with Administrator privileges for the commands below. These examples use Command Prompt, where the PsExec executable can be run by name from its folder. PowerShell does not search the current folder by default; see PowerShell command precedence if using that shell instead.

  3. Extract the downloaded tools, then navigate to the folder containing the PsExec executable. Replace the example script path with the full path to your own script and keep the quotation marks, especially when the path contains spaces.

  4. Use the following command to run the script as SYSTEM with 64-bit Windows PowerShell: PSEXEC -accepteula -i -s C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -File "path\to\script.ps1"

Example:

PSEXEC -accepteula -i -s C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -File "C:\test\testscript.ps1"

To reproduce a known 32-bit execution path, use C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe instead.

Related Content

Digging Deeper

PsExec Switches

  • -i: runs the process interactively in the specified or current console session.

  • -s: runs the process as the local SYSTEM account.

  • -d: starts the process without waiting for it to finish. Omit this switch when you need to read script output during testing.

  • -accepteula: accepts the PsExec license agreement for the test run.

Calling 64-bit PowerShell from a 32-bit process

Keep this compatibility pattern only for scripts that can still start in a 32-bit process and must relaunch themselves in 64-bit PowerShell. Sysnative bypasses Windows filesystem redirection from that 32-bit process.

If ( [IntPtr]::Size * 8 -ne 64 )
{
    C:\Windows\SysNative\WindowsPowerShell\v1.0\PowerShell.exe -File $MyInvocation.MyCommand.Path
}
Else
{
    # Add code here
}

The code checks the current process architecture. A 32-bit process relaunches the same script through Sysnative; a 64-bit process continues into the Else block.

Run the test on a representative Windows device, review the exit code and output, and confirm the intended change. The interactive PsExec test reproduces the SYSTEM account, but not every part of a FileWave deployment: supply the same required arguments and environment values, and check paths and execution bitness. Pilot the actual Fileset or Custom Field through FileWave before expanding the deployment.

No comments to display