Registry mapping differs between paexec and psexec

[deajan]

Hello,

Using Windows 10 (latest 1803 build up to date) x64, paexec does not correctly map HKLM\Software key between normal and system accounts.

Exemple:
paexec -i -s reg add HKLM\Software\Test /v Some /t REG_SZ /d Value /f will create the TEST key in WOW6432Node subkey.
Hence,
paexec -i -s reg query HKLM\Software\Test will work.
reg query HKLM\Software\Test will return an error since it won't find the Test key.

Running the same commands with psexec will work.

Best regards.

[deajan]

Playing a bit further with that bug, I can confirm that even running regedit as system with paexec won't show the the registry key created with PSExec.

[n-mam]

add /reg:64 switch at the end.

reg query HKLM\Software\Test /reg:64

[poweradminllc]

Are you using the 64-bit version of PsExec when you test?