samba - Nov 2024 - Windows permissions

I think I'm fairly good with Linux (since 1991) but mostly clueless
with Windows. When I need Windows help, the Web has been my savior.
But not this time...

I have three Windows 10 boxes which I can successfully access
using xfreerdp so I presume I know the available users and
passwords. However, trying to access with winexe is proving difficult.

1. The command, <winexe -U winuser ...>, immediately prompts me for
"dave's" (my) password. I don't have an account under my own
name on
the Windows boxes and winuser != dave. I think I resolved this using
smbpasswd to create an SMB user for myself on Linux. It seems that I
also needed to create an SMB user for winuser on Linux. But although
I gave SMB winuser his correct Windows password, winexe doesn't seem
to use it, prompting me for the password. (All three boxes have the
same user, winuser, with the same password.)

2. For two of the Windows boxes, the command < winexe -d 2
-U winuser%password //address "systeminfo" > returns the error,

  winexe_svc_install: dcerpc_svcctl_CreateServiceW failed: WERR_ACCESS_DENIED
  main: winexe_svc_install failed: NT_STATUS_ACCESS_DENIED

However, for the third box, the same command returns the error,

  main: cli_full_connection_creds failed: NT_STATUS_IO_TIMEOUT

("address" is, of course, different for each of the commands.) I have
no trouble running the systeminfo command in a cmd shell on the three
boxes when connected with RDP. I'm using systeminfo here as a simple
command just to prove that I can get something to work.

I presume these errors are caused by some improperly set configuration
on the Windows boxes but I have no idea what to change to fix them.
All winexe examples I seen seem to presume that connections will work
and don't say what to do when they don't. Please help me.
-- 
         Dave Close, Compata, Irvine CA       +1 714 434 7359
       dave at compata.com              dhclose at alumni.caltech.edu
  "We consider too much the good luck of the early bird and
   not enough the bad luck of the early worm." -- Franklin Roosevelt

I wrote:
>I think I'm fairly good with Linux (since 1991) but mostly clueless
>with Windows. When I need Windows help, the Web has been my savior.
>But not this time...
>
>I have three Windows 10 boxes which I can successfully access
>using xfreerdp so I presume I know the available users and
>passwords. However, trying to access with winexe is proving difficult.
>
>1. The command, <winexe -U winuser ...>, immediately prompts me for
>"dave's" (my) password. I don't have an account under my
own name on
>the Windows boxes and winuser != dave. I think I resolved this using
>smbpasswd to create an SMB user for myself on Linux. It seems that I
>also needed to create an SMB user for winuser on Linux. But although
>I gave SMB winuser his correct Windows password, winexe doesn't seem
>to use it, prompting me for the password. (All three boxes have the
>same user, winuser, with the same password.)
>
>2. For two of the Windows boxes, the command < winexe -d 2
>-U winuser%password //address "systeminfo" > returns the error,
>
>  winexe_svc_install: dcerpc_svcctl_CreateServiceW failed:
WERR_ACCESS_DENIED
>  main: winexe_svc_install failed: NT_STATUS_ACCESS_DENIED
>
>However, for the third box, the same command returns the error,
>
>  main: cli_full_connection_creds failed: NT_STATUS_IO_TIMEOUT
>
>("address" is, of course, different for each of the commands.) I
have
>no trouble running the systeminfo command in a cmd shell on the three
>boxes when connected with RDP. I'm using systeminfo here as a simple
>command just to prove that I can get something to work.
>
>I presume these errors are caused by some improperly set configuration
>on the Windows boxes but I have no idea what to change to fix them.
>All winexe examples I seen seem to presume that connections will work
>and don't say what to do when they don't. Please help me.
After lots of searching and multiple failed tries, my problem was resolved with
a policy change on
the Windows boxes. The solution came from the last idea (currently) in 
<https://superuser.com/questions/1013702/completely-disable-uac-in-windows-10>:

  Use gpedit.msc to access and disable the entry,
    Computer Configuration
    -> Windows Settings
    -> Security Settings
    -> Local Policies
    -> Security Options
    -> User Account Control
    Run all administrators in Admin Approval Mode
-- 
Dave Close, Compata, Irvine CA      "You can only be young once
dave at compata.com, +1 714 434 7359    but you can be immature forever."
dhclose at alumni.caltech.edu             -- Dave Barry