run script block as a specific user with Powershell

Question

I am not getting anywhere when using Start-Process / Start-Job cmdlets with -Credential $cred

Problem

I have a service account use in deployment (unattended mode). Previously it has been added to local administrator group. I want to reduce potential damage I could do by removing this user from admin group and explicitly assign folder permissions to this user.

I rather get a permission error than execute something that is reaching out by accident. Remove-Item "$notdefined\*"

However in this same powershell script i want to be able to elevate to execute things like:

sc.exe
app pool restart which requires an admin user.

One of my failed attempts

$job = Start-Job -ScriptBlock { 

param(
    [string]$myWebAppId
)

Import-Module WebAdministration

Write-Host "Will get the application pool of: IIS:\Sites\$myWebAppId and try to restart"
$appPoolName = Get-ItemProperty "IIS:\Sites\$myWebAppId" ApplicationPool 
Restart-WebAppPool "$($appPoolName.applicationPool)" 
Write-Host "restart of apppool succeeded."

} -Credential $cred -ArgumentList @("appname")

Write-Host "started completed"

Wait-Job $job

Write-Host "wait completed"

Receive-Job $job -Verbose

Write-Host "receive completed"

I found one possible solution powershell.com/cs/blogs/tobias/archive/2010/10/28/… - although hoping there is a way to use $cred which i retrieve with a securestring — Leblanc Meneses
– Leblanc Meneses, Commented Aug 14, 2012 at 9:18

justinf · Accepted Answer · 2012-08-14 10:26:55Z

1

Hi this might be an example that might work for you let me know if it does.

$global:credentials = new-object -typename System.Management.Automation.PSCredential 


$job = Start-Job -ScriptBlock {Get-Service} -Credential $credentials

Wait-Job $job

Receive-Job $job

answered Aug 14, 2012 at 10:26

justinf

1,3282 gold badges21 silver badges39 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Leblanc Meneses Over a year ago

Get-Service doesn't require elevated permissions - try Stop-Service $serviceName -Force . It doesn't work still...

Leblanc Meneses · Accepted Answer · 2012-08-14 19:27:46Z

1

I ended up enabling WinRM using WinRM quickconfig

I was then able to use Invoke-Command

    $cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $username, $password

Invoke-Command {
    param(
        [string]$WebAppName 
    )
     #elevated command here

} -comp $computerName -cred $cred  -ArgumentList @("$myWebAppId")

answered Aug 14, 2012 at 19:27

Leblanc Meneses

3,0911 gold badge25 silver badges29 bronze badges

Comments

x0n · Accepted Answer · 2012-08-14 21:43:18Z

0

While there's no quick and easy way to do this in PowerShell 2.0, version 3.0 (currently in RC, mostly likely RTW very soon given that Windows 8 RTW will appear on MSDN/Technet tomorrow) supports the notion of configuring remoting endpoints with a custom identity. This would be done with the Register-PSSessionConfiguration cmdlet on the computer where you want the command to run, which may be the local computer. Then, when using Invoke-Command, provide a session with the -Session parameter. The session is created using the New-PSSession cmdlet, which lets you specify the computer and the configuration name (which is tied to the custom identity.)

Clear as mud?

answered Aug 14, 2012 at 21:43

x0n

52.6k8 gold badges97 silver badges116 bronze badges

Comments

Adam Erickson · Accepted Answer · 2024-10-21 19:38:42Z

0

For the admin account, there is a quick and dirty solution:

$Var1 = 1
$Var2 = 2
$Var3 = 3

Start-Process -FilePath 'pwsh.exe' -Verb 'RunAs' "-Command & {
    Some-Command -Arg $Var1
    Some-Command -Arg $Var2
    Some-Command -Arg $Var3
}"

Creating a ScriptBlock and invoking it with arguments passed into it is a pain in comparison.

answered Oct 21, 2024 at 19:38

Adam Erickson

6,4532 gold badges48 silver badges37 bronze badges

Collectives™ on Stack Overflow

run script block as a specific user with Powershell

Problem

One of my failed attempts

4 Answers 4

1 Comment

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

Problem

One of my failed attempts

4 Answers 4

1 Comment

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related