winexe

Excelent utility, indispensable in the toolbox of any unix/windows admin.

There are two big problems. It's poorly integrated on top of Samba4, without any documentation or guidelines to how it was assembled on top of Samba4. This makes it a maintenance problem, especially if you run it on a system with Samba3 already in place and it goes looking in /etc/samba/smb.conr for incompatible configurations or inappropriate configurations. The other is the security model. Based on psexec, it relies on plain-text local password parsing or even text file storage to provide. Once you have those stashed for easy operations, you can kiss security goodbuy, because anyone *else* who can get those passwords from your Linux box or your scripts or your Subversion stored configurated files or your backup tapes has admin access to every box they can reach. I know a lot of people who say "if they're inside our network, we have much bigger problems". But you may as well write shell scripts with your root passwords in them. I'm not sure if psexec uses kerberized access, such as is built into Active Directory: given that this is based on Samba4, it *could* use Kerberos keys. That would mean a rewrite of the access modules, which I unfortunately do not understand well enough to rewrite myself. But since the server authentication used to install the "service" for winexe needs administrative privileges on the Windows target, it's a big deal.

Winexe is a "clone" for sysinternals psexec and open the door to manage and do magic from a *nix machine to the windows domain machines