rmtexec("notepad.exe","wheelerc_2nd")
? @error @serror

;****************************************************************************************************
FUNCTION RMTEXEC($cmd, $computer, optional $pid)
dim $rmt, $exec
if not $pid $pid=999 endif

$rmt = GetObject("winmgmts:{impersonationLevel=impersonate}!\\$computer \root\cimv2:Win32_Process")
$exec = $rmt.Create($cmd,,,$pid)

exit @error
ENDFUNCTION

Function RemoteRun ($RemoteCommand, Optional $RemoteStartDir, Optional $ComputerName, Optional $AdminName, Optional $AdminPassword, Optional $NameSpace)
Global $RemoteProcessPid
If Not $ComputerName Or $ComputerName = ''
$ComputerName = @Wksta
EndIf
If $NameSpace = ''
$NameSpace = 'root\cimv2'
EndIf
$SystemLocator = CreateObject ('WbemScripting.SWbemLocator')
$SystemSet = $SystemLocator.ConnectServer($ComputerName, $NameSpace, $AdminName, $AdminPassword)
If @Error <> 0
$WMIQuery = ''
Exit @Error
EndIf
$SystemSet.Security_.ImpersonationLevel = 3
$ObjProcesses = $SystemSet.Get('Win32_Process')
$ObjProcessIns = $ObjProcesses.Methods_('Create').InParameters.SpawnInstance_
$ObjProcessIns.CommandLine = $RemoteCommand
If $RemoteStartDir And $RemoteStartDir <> ''
$ObjProcessIns.CurrentDirectory = $RemoteStartDir
EndIf
$ObjProcessOut = $SystemSet.ExecMethod('Win32_Process', 'Create', $ObjProcessIns)
If @Error = 0
$RemoteProcessPid = $ObjProcessOut.processid
Else
$RemoteProcessPid = ''
EndIf
Exit $ObjProcessOut.returnvalue
EndFunction

set wmiobj=GetObject("winmgmts:")
set procobj = wmiobj.ExecQuery("Select * From Win32_Process Where Name = 'iexplore.exe'")
For each Process in procobj
RetVal = Process.GetOwner(struser,strdomain)
wscript.echo struser
wscript.echo strdomain
Next

$computer = "@WKSTA"
$uName = ""
$upass = ""
$namespace = "root\cimv2"
$command = "c:\winnt\system32\cmd.exe"
$sysloc = CreateObject("WbemScripting.SWbemLocator")
$sysset = $sysloc.ConnectServer($computer, $namespace, $uname, $upass)
$sysset.Security_.ImpersonationLevel = 3

$objProcStart = $sysset.Get("Win32_ProcessStartup")
$ProcStartInst = $objProcStart.SpawnInstance_
$ProcStartInst.Title = "Hi, How are you?"
$ProcStartInst.ShowWindow = 1 ; this part doesn't seem to work right.
$procStartInst.Put_

$objProc = $sysset.Get("Win32_Process")
$objProcInst = $ObjProc.Methods_("Create").InParameters.SpawnInstance_
$objProcInst.CommandLine = $command
$objProcInst.ProcessStartupInformation = $ProcStartInst
$objProcOut = $sysset.ExecMethod("Win32_Process","Create",$objProcInst)
$pid = $objProcOut.Processid
"PID used is: " + $pid

B/c authentication simply verifies to the remote WMI provider you are who you say you are. It does not allow for proxy pass-through authentication or redirection. In this case the transmission between the two will be encrypted at the RPC level.

Also, here's the quote from the other post on NTLM:

quote:
Shawn,

LOL! I've been down that road already! I didn't want to bring it up in fear that I would be laughed off the board!

Here's our problem... I tried setting the $RCommand to "cmd /c net use z: \\server\share /persistent:no & pause" and sure enough... System Error 1312

This MSKB describes and also hints towards delegation. Unfortunately, without kerberos, this is worthless.

This is beginning to look like an exercise in futility...

quote:
--------------------------------------------------------------------------------

When you use Telnet to map a drive letter to a network share, the procedure may not work and the following error message may be displayed:

A specified logon session does not exist. It may already have been terminated.
NOTE : This problem does not affect Telnet sessions for which the user authentication method is clear text.

CAUSE
This issue occurs when you open a Telnet session to a computer running Windows NT Server using the NTLM authentication method. You cannot then, from within the Telnet session, connect to network resources using your implied user credentials. You must explicitly specify your credentials when making network connections from within the Telnet session.

There is no mechanism in Windows NT to perform delegation of security (pass through) for network logon attempts.

For example, if you log on to the network using NTLM from computer A to computer B, and then type "net use" at a command prompt to connect to computer C from computer B, the connection is not made. The reason is that computer B has an incomplete user token (it does not have your password), so the logon attempt to computer C does not work. This behavior is rooted in NTLM being a challenge/response protocol, and as such, it avoids sending your password across the network.

--------------------------------------------------------------------------------

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q214726