Surender Kumar

You can use the same procedure as mentioned in this post. If you’re going to be creating only a single VM in Azure from imported disk, you could skip the Sysprep step.

Glad to know you found it useful. 😊

First of all, make sure you’re running psexec in an elevated cmd or powershell session.

Now coming to LocalAccountTokenFilterPolicy; This is the default behavior on PCs having User Account Control (UAC) enabled – to prevent local accounts from accessing remote administrative shares (e.g., admin$) over a network. If you want to allow this access, you need to use a domain user, add it to local administrators group on remote computer, and then it will work with psexec without any error. When a domain user is a member of administrators group and remotely logs on to UAC enabled PC, the user will get a high integrity-level on remote PC. You can read about integrity levels here:

icacls: List, set, grant, remove, and deny permissions

If you cannot use a domain account, you need to set “LocalAccountTokenFilterPolicy” to run psexec. The value “1” grants an elevated token to remote sessions from all local administrators. This is essentially equivalent to disabling UAC for remote sessions. But be aware that doing so could allow tools like Mimikatz and Metasploit to pass-the-hash which could be a security risk.