Running quser.exe in PowerShell scripts works in IDE but not when running as a service

Question

If I run the following snippet in a console window or in ISE it works as expected, listing the active user sessions on the local computer:

(Invoke-Expression "$env:windir\system32\quser.exe") -replace '\s{2,}', ',' | ConvertFrom-Csv

Unfortunately this is not a console application, rather a PowerShell script that is installed as a service. The service runs as LocalSystem (not LocalService). When the service attempts to run this code it outputs the following error:

The term 'C:\Windows\system32\quser.exe' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

I contacted Sapien support and was informed that A service runs with no profile and does not have execution access to the system folders. You need to give the service account execution access to the exe and its support DLLs as well as using the full path to the EXE.

I have proven (I think) that the security principal has access to quser. I used PSExen to open a PowerShell console running as LocalSystem and successfully ran the quser application:

The issue MUST be that I'm running as a service. Does anyone know how I can access/use QUser in a service?

I guess the real question would be, how can services running as LocalSystem execute applications in system folders?

Answer 1

My guess is that whatever tool you are using to run your PowerShell script as a service is 32-bit, and there is not a quser.exe in C:\Windows\SysWOW64.

If this is the case, you can probably work around this on a 64-bit OS by running C:\Windows\Sysnative\quser.exe (see File System Redirector in the documentation for details).

If that's the case, I would say that the information you got ("service runs with no profile and does not have execution access to the system folders") is simply incorrect.