Fixed: Couldn't Install PsExec Service Access Is Denied on Windows

This post primarily introduces how to fix couldn't install PsExec service access is denied on Windows 10 and 11. If you are facing this issue, try the solutions mentioned in this post to solve it.

Ellie

By Ellie / Updated on April 4, 2023

Share this: instagram reddit

PsExec error: Couldn't install PsExec service access is denied

 

I plan to remotely access from one machine to another, using PsExec, to start/stop a net service. But it said that Couldn't access MACHINE_IP: Access denied. What's wrong with that? Any ideas would be very appreciated.”

- Question from Spiceworks

How to fix couldn't install PsExec service access is denied [3 solutions]

Sometimes, you will encounter couldn't install PsExec service access is denied issue on Windows 10 and 11. Don't worry. Here are three tested solutions to fix it.

Solution 1. Enable logon in GPO on the domain

There is a GPO on the domain that needs to be added. Once done, all PowerShell scripts on your shared folder could be successfully executed on all systems with PsExec.

Step 1. Press Win + R, type "gpedit.msc", and click OK.

Run Box gpedit.msc

Step 2. Go to Computer Configuration > Windows settings > Security Settings > Local Policies > User Rights Assignment. Find "Allow log on locally" and "Allow log on through Remote Desktop Services".

Allow Log on Locally

Step 3. Ensure "Allow log on locally" and "Allow log on through Remote Desktop Services" are enabled with your admin account listed.

Have Admin Account Listed

Solution 2. Disable UAC on Registry

On Windows 7/8/10/11, UAC is enabled by default and is set to filter a network logon of a local account of their Administrative rights. Could not start PsExec service on the target machine because PsExec still tries to access the ADMIN$ share with your local credentials before executing your command as another user. To get around this, follow the steps below to make a registry change.

Step 1. Press Win + R, type "regedit", and click OK.

Run Box Regedit

Step 2. Navigate to HKEY_LOCAL_MACHINE > SOFTWARE > Microsoft > Windows > CurrentVersion > Policies > System. Right-click the blank space to add a new DWORD value called LocalAccountTokenFilterPolicy.

System Add Dword Value

Step 3. Set its value to 1.

Local Account Token Filter Policy

Step 4. Reboot your remote server. Try rerunning PsExec from your local server.

Solution 3. Allow using PsExec with an empty password

By default, Windows will not allow you to log in with a user account that has an empty password. If you change the admin account's password on the target machine to nothing, you'll encounter could not install PsExec service access is denied issue. This prompted another investigation. Here's what you need to do to use PsExec with an empty password.

Step 1. Press Win + R, type "secpol.msc", and click OK.

Local Security Policy Window

Step 2. Navigate to Local Policies > Security Options. Find "Accounts: Limit local account use of blank passwords to console logon only".

Security Code Options Accounts

Step 3. Please change it to Disabled.

Disable Local Security Settings

Bonus tip: An easier way to remotely access a PC

You need an easier way to access a PC remotely. For example, using a remote desktop tool like AnyViewer. AnyViewer is a free, simple, and secure remote desktop software. It has an intuitive interface, and even a computer illiterate can quickly get started. Besides, it also provides many practical features, like file transfer, screen sharing, remote restart, etc.

Download Freeware Win PCs & Servers
Secure Download

Step 1. On both computers, download, install, and launch AnyViewer. Go to Log in on the Controller computer, and then click Sign up (if you have already signed up on its official website, you can log in directly).

Log in AnyViewer

Step 2. Fill out the signup form.

Sign Up for AnyViewer

Step 3. You should now see that you have successfully logged into AnyViewer. Your device will be assigned to the account to which you have logged in automatically.

Free Editions

Step 4. Sign in with the same AnyViewer account on both computers, then click the One-click control for unattended remote access.

Connect to My Devices

Notes:✎...
It is recommended to upgrade your account to a Professional or Enterprise plan. What can a professional or enterprise plan brings to you:
More devices will be allowed to assign to the same account for unattended access.
More connection channels for more devices to be able to start remote connection at the same time.
One device can connect to more devices simultaneously.
Black the remote PC screen and disable the remote keyboard & mouse click to protect privacy.
Transfer 1TB files at 10 MB/s.

 

The bottom line

This post primarily introduces three solutions to fix couldn't install PsExec service access is denied on Windows 10 and 11. If the three solutions are not helpful, you are advised to use a more accessible remote access tool AnyViewer. It has a simple setup process and powerful features. Try it right now.