PsExec是微軟釋出的工具之一，用於遠端執行。PowerShell擁有Invoke-Commond來遠端執行，並且很方便地返回遠端執行的結果，但是對於有UI的session互動的遠端呼叫，不方便控制UI所在的session，但是PsExec就可以解決這個問題，下面是PsExec的官方Doc：

Introduction

Utilities like Telnet and remote control programs like Symantec's PC Anywhere let you execute programs on remote systems, but they can be a pain to set up and require that you install client software on the remote systems that you wish to access. PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. PsExec's most powerful uses include launching interactive command-prompts on remote systems and remote-enabling tools like IpConfig that otherwise do not have the ability to show information about remote systems.

Note: some anti-virus scanners report that one or more of the tools are infected with a "remote admin" virus. None of the PsTools contain viruses, but they have been used by viruses, which is why they trigger virus notifications.

Installation

Just copy PsExec onto your executable path. Typing "psexec" displays its usage syntax.

Using PsExec

See the July 2004 issue of Windows IT Pro Magazine for Mark's article that covers advanced usage of PsExec.

Usage: psexec [\\computer[,computer2[,...] | @file]][-u user [-p psswd][-n s][-r servicename][-h][-l][-s|-e][-x][-i [session]][-c [-f|-v]][-w directory][-d][-<priority>][-a n,n,...] cmd [arguments]

You can enclose applications that have spaces in their name with quotation marks e.g.

psexec \\marklap"c:\long name app.exe"

Input is only passed to the remote system when you press the Enter key. Typing Ctrl-C terminates the remote process.

If you omit a user name, the process will run in the context of your account on the remote system, but will not have access to network resources (because it is impersonating). Specify a valid user name in the Domain\User syntax if the remote process requires access to network resources or to run in a different account. Note that the password and command are encrypted in transit to the remote system.

Error codes returned by PsExec are specific to the applications you execute, not PsExec.

Examples

This article I wrote describes how PsExec works and gives tips on how to use it:

The following command launches an interactive command prompt on \\marklap:

psexec \\marklap cmd

This command executes IpConfig on the remote system with the /all switch, and displays the resulting output locally:

psexec \\marklap ipconfig /all

This command copies the program test.exe to the remote system and executes it interactively:

psexec \\marklap -c test.exe

Specify the full path to a program that is already installed on a remote system if its not on the system's path:

psexec \\marklap c:\bin\test.exe

Run Regedit interactively in the System account to view the contents of the SAM and SECURITY keys::

psexec -i -d -s c:\windows\regedit.exe

To run Internet Explorer as with limited-user privileges use this command:

psexec -l -d "c:\program files\internet explorer\iexplore.exe"

下載地址：http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx

下面是powershell與psExec結合做遠端呼叫的例子

[string]$LogPath = "E:\PowerShellScript\Log\Log.txt"
[string]$PsExecPath = "D:\PSTools\PSTools"
[string]$AgentPath = "E:\PowerShellScript"
# Auth:Justin
# Date:2014-10-24
# Desc:To get random number
function RemoteAgent($Action,$ActionInput)
{
	try
	{
		PUSHD $PsExecPath
		$Arguments = $Action,$ActionInput
		#PsExec -d powershell "$AgentPath\PsAgent.ps1 $Arguments"
		PsExec -d powershell "$AgentPath\PsAgent.ps1 $Arguments"
		POPD
	}
	catch
	{
		Write-Host "Exception."
	}	
}

<span style="font-family:Microsoft YaHei;">param
(
	[string]$Action,
	[object]$ActioInput
)

function DoWork
{
	#Write-Host $Action
	#Write-Host $ActioInput
	switch($Action)
	{
		"PrintWelcome"
		{
			PrintWelcome $ActioInput
		}
		"WriteLetter"
		{
			WriteLetter $ActioInput
		}
		"Squre"
		{
			Squre $ActioInput
		}
	}
}

function PrintWelcome($Name)
{
	Write-Host "Hello "$Name", Welcome to School!"
}

function WriteLetter($Receiver)
{
	Write-Host "Hi $Receiver!" -ForegroundColor WHITE
	Write-Host "I miss you so much..." -ForegroundColor WHITE
}

function Squre($Num)
{
	return $Num*$Num
}

Write-Host "---The function has finished---" -ForegroundColor Green
DoWork
Write-Host "---The function has finished---" -ForegroundColor Green
Write-Host "Please press ENTER to exit."
Read-Host </span>