[OO Support Tip] How does the Remote Command Execution (RCE) operation work?
How does the Remote Command Execution (RCE) operation work?
RCE works by calling WMI to process the command on the remote host. An IPC connection is then made to the box with the value specified or by default to the Admin share.
This means that by default the command runs in the context of the WMI service which is LocalSystem. LocalSystem cannot access remote resources. In 9.0 a hidden input was added that allows delegation/impersonation. To use it add a Input to the RCE operation called useDelegation. This accepts boolean inputs true/false. If set to true the operation will attempt to create a process under WMI as the user specified in the operation. In 9.00.03 the behavior was changed and impersonation/delegation is always attempted.
Direct link to the document here:
If you find that this or any post resolves your issue, please be sure to mark it as an accepted solution.