projectdiscovery/nuclei · error

open atsvc pipe: %w

Error message

open atsvc pipe: %w

What it means

AtExec opens the atsvc named pipe and the open failed. The Task Scheduler RPC endpoint is absent (Schedule service stopped or disabled) or the session is denied the pipe open. Same failure class as error 200/209, specific to the scheduled-task execution path.

Source

Thrown at pkg/js/libs/dcerpc/dcerpc.go:388

//
// @example
// ```javascript
// const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss');
// const r = c.AtExec('whoami /all', 'ADMIN$');
// log(r.output);
// ```
func (c *Client) AtExec(command, share string) (*AtExecResult, error) {
	c.nj.Require(command != "", "command cannot be empty")
	if !protocolstate.IsHostAllowed(c.nj.ExecutionId(), c.Host) {
		return nil, protocolstate.ErrHostDenied.Msgf(c.Host)
	}
	if err := c.connect(); err != nil {
		return nil, err
	}

	pf, err := c.smb.OpenPipe("atsvc")
	if err != nil {
		return nil, fmt.Errorf("open atsvc pipe: %w", err)
	}
	defer func() { _ = pf.Close() }()

	rpc := gprpc.NewClient(pf)
	if err := rpc.BindAuth(gptsch.UUID, gptsch.MajorVersion, gptsch.MinorVersion, c.creds); err != nil {
		return nil, fmt.Errorf("tsch bind: %w", err)
	}
	ts := gptsch.NewTaskScheduler(rpc)

	res, err := gpatexec.Exec(ts, c.smb, command, gpatexec.Options{
		Share:     share,
		Timeout:   15 * time.Second,
		SessionID: -1,
	})
	if err != nil {
		return nil, err
	}
	return &AtExecResult{TaskName: res.TaskName, Output: res.Output}, nil

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Ensure the Task Scheduler service is running on the target.
2. Use administrator credentials for scheduled-task execution.
3. Verify the pipe exists (RpcDump / pipe listing) before choosing AtExec.
4. Fall back to SmbExec over svcctl if atsvc is unavailable.

Example fix

// before
c.AtExec('whoami', 'C$'); // open atsvc pipe: OBJECT_NAME_NOT_FOUND

// after
try {
  c.AtExec('whoami', 'C$');
} catch (e) {
  if (String(e).includes('open atsvc pipe')) {
    c.SmbExec('whoami', 'ADMIN$'); // svcctl path instead
  } else throw e;
}

try {
  const r = c.AtExec(cmd, 'C$');
} catch (e) {
  const msg = String(e);
  if (msg.includes('open atsvc pipe')) {
    c.SmbExec(cmd, 'ADMIN$'); // Task Scheduler surface missing → SCM path
  } else throw e;
}

When it happens

Trigger: Client.AtExec(command, share) where the Task Scheduler service is disabled, the pipe ACL denies the account, or EDR blocks atsvc opens.

Common situations: Hardened builds with the Task Scheduler service disabled; non-admin credentials; EDR watching at-* pipes.

Related errors

• open pipe %q: %w
• encountered errors while performing template validation
• no templates provided for scan
• no input provider found
• no templates provided for scan

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/a4d71c2983ef8cdd. Report an issue: GitHub.