具有存储凭据的Start-Process PowerShell无法正常工作

Question

I have a script that must be run as an elevated user. I'm using the code from the question " Running a PowerShell script as administrator without typing in passwords " but my 2nd script is not being called. The first script gets triggered by a system process (my ticketing system getting an email, then it calls my elevation script with the subject line as a parameter), and simply using a scheduled task is not an option.

The calling script:

param(
    [Parameter(Mandatory=$true)]
    [String]$MyParam
)

$LogFile = "c:\temp\log.txt"

$encpwd = Get-Content c:\temp\password.bin
$passwd = ConvertTo-SecureString $encpwd
$cred = new-object System.Management.Automation.PSCredential 'domain\LocalAdminAccount',$passwd
Add-Content $LogFile "I am running as $env:userdomain\$env:username"
Add-Content $LogFile "Trying to call the script with the parameter: $MyParam"
try {
    Add-Content $LogFile "Calling script"
    Start-Process PowerShell -WorkingDirectory 'C:\Windows\System32' -Cred $cred -ArgumentList '-File', "c:\temp\TargetScript.ps1 $MyParam"
    Add-Content $LogFile "Script called"
} catch {
    $msg = $Error[0].Exception.Message
    Add-Content $LogFile "Error caught: $msg"
}
Add-Content $LogFile "Error caught: $msg"

The called script:

param(
    [Parameter(Mandatory=$true)]
    [String]$PassedParam
)
$LogFile = "c:\temp\log.txt"

Add-Content $LogFile "I am running as $env:userdomain\$env:username"
if ($PassedParam) {
    try {
        #stuff
        if ($?) {
            Add-Content $LogFile "$PassedParam worked"
        } else {
            Add-Content $LogFile "Failed"
        }
    } catch {
        $msg = $Error[0].Exception.Message
        Add-Content $LogFile "Error caught: $msg"
    }
}
Add-Content $LogFile "Error caught: $msg"

And this is what gets put in the log file:

I am running as DOMAIN\COMPUTER$
Trying to call the script with the parameter: Tim
Calling script

It never seems to actually start the 2nd powershell process, or at least if it does, the 2nd powershell process isn't writing to the log file. I specifically granted the LocalAdminAccount full rights to the log file and password.bin file, and the LocalAdminAccount is in the administrators group on the computer.

And in case it matters, my powershell version is:

PS C:\> $PSVersionTable.PSVersion
Major  Minor  Build  Revision
-----  -----  -----  --------
4      0      -1     -1

Update: If I log in to the computer and run the script as myself, Here's is what the log file shows:

I am running as DOMAIN\TIM
Trying to call the script with the parameter: Tim
Calling script
Script called
I am running as DOMAIN\LocalAdminAccount
Tim worked
Error caught: 

Update: I did find this article: https://www.pdq.com/blog/secure-password-with-powershell-encrypting-credentials-part-2/ which shows I need to provide a decryption key for the password since I made the password file under my account but it is being decrypted by NT SYSTEM. That didn't fix my issue though.

I did more testing by simply trying to call notepad. It fails if I try to open it as a different user, but if I just try to open it I can see it in Task Manager running under the SYSTEM user name.

My issue really seems to be that SYSTEM (DOMAIN\\COMPUTER$) does not have the ability to run a process as a different user?

Answer 1

Run the main script commands from interactive PowerShell window as System (see: Run PowerShell as System .

This will reveal the error:

This command cannot be run due to the error: Access is denied.

This issue has been described at: Powershell Start-Process : This command cannot be executed due to the error: Access is denied and is defined by the local policy:

Security Settings
    Local Policies
        User Rights Assignment
            Impersonate a client after authentication

Answer 2

To run a script in another process, remember PowerShell always runs in the context for the user who started it, thus you need to set your script to auto-elevate / at minimu use the RunAs verb.

Start-Process PowerShell -verb RunAs -Cred $cred -ArgumentList '-noexit','-File','path-to-script' 

or say in a notepad or other script use case...

Start-Process powershell -Credential mydomain\mydomainAdmin -ArgumentList '-noprofile -command &{Start-Process notepad -verb runas}'

… as the pointer you are using shows. You are not using that anywhere in the code you posted. You must start another process separate to run as another user.

Answer 3

As a work around, I've created a scheduled task that runs as my serviceadmin. Now when the ticketing system triggers a script that calls the scheduled task, and the scheduled task runs the second script which requires elevation. This is not ideal, but it does work as desired.

The Scheduled Task (named Step 2)

<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2019-08-01T09:12:24.7058452</Date>
    <Author>Tim</Author>
    <Description></Description>
  </RegistrationInfo>
  <Triggers />
  <Principals>
    <Principal id="Author">
      <UserId>Domain\ServiceAccount</UserId>
      <LogonType>Password</LogonType>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    all defaults. Removed for brevity.
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe</Command>
      <Arguments>-file "C:\Temp\Step2.ps1"</Arguments>
    </Exec>
  </Actions>
</Task>

Step1.ps1 (The calling script)

param(
    [Parameter(Mandatory=$true)]
    [String]$MyParam
)

$LogFile = "c:\Temp\Actions.log"
$ParamFile = "c:\Temp\Params.txt"
Remove-Item $ParamFile
$MyParam | Out-File -FilePath $ParamFile
Add-Content $LogFile "$MyParam written to file."
Add-Content $LogFile "Calling Step 2 task."
Start-ScheduledTask -TaskName "Step 2"

Step2.ps1 (the called script)

$LogFile = "c:\temp\log.txt"
$ParamFile = "c:\Temp\Params.txt"
$PassedParam = Get-Content $ParamFile
Add-Content $LogFile "I am running as $env:userdomain\$env:username"
if ($PassedParam) {
    try {
        #stuff
        if ($?) {
            Add-Content $LogFile "$PassedParam worked"
        } else {
            Add-Content $LogFile "Failed"
        }
    } catch {
        $msg = $Error[0].Exception.Message
        Add-Content $LogFile "Error caught: $msg"
    }
}
Add-Content $LogFile "Step 2 complete"

I am not going to mark this as the answer because it solves my problem using a work around, but it does not answer my question.

Answer 4

My suggestion is to grant the computer account access to the directory objects in question (the most obvious way being to add the computer's account to a group that has the necessary permissions in the directory) and run the script on that computer using the SYSTEM account. This seems to me to be the most straightforward and least complex solution for your scenario.