Different netstat output: cmd line vs script

[DrLarch]

Not sure why this is happening - when I run netstat -abn from a command line I get this:

 [svchost.exe]
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING
 Can not obtain ownership information
  TCP    0.0.0.0:5000           0.0.0.0:0              LISTENING

But when I run it from this script:

#RequireAdmin

Local $str = ''
Local $pid = Run(@WindowsDir & '\system32\netstat.exe -abn', '', @SW_HIDE, 2)
While ProcessExists($pid)
    $str &= StdoutRead($pid)
WEnd

FileWrite(@ScriptDir & "\portdump.txt",$str)

Exit

... I get this:

 [system]
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING
 Can not obtain ownership information
  TCP    0.0.0.0:5000           0.0.0.0:0              LISTENING

I'm missing the executable in the brackets via the script, instead I just get "System". I thought #RequireAdmin would help, but no change. I also tried using RunAs with my admin credentials (even though I'm running the script from my account), but no difference.

Any ideas?

[water]

Have you tried

Run(@ComSpec & " /c " & 'commandName', "", @SW_HIDE)

as described in the help file?

[BrewManNH]

I can't duplicate that problem, I'm getting the program name when I run the script.

[DrLarch]

Well one thing I found is that if I run the syswownetstat.exe from a command line I don't get the exe names, but the one in my system32 folder works fine. I changed the path in the script to use the system32 one, but no difference. And water, yes, I just tried changing it to use @ComSpec & " /c " but no difference. If no one can reproduce this, then maybe it's some security settings in our domain perhaps. But that still doesn't make sense as I can get the proper output from a command line.

[DrLarch]

Ok, I found it. I actually ran into this before with W7/64 redirecting registry read/writes to syswow64, but didn't realize it did this with directories as well. After I changed the path directly to C:\Windows\System32\netstat.exe and ran the script as x64 it works.