How can I call a PowerShell script as a particular

问题:

When I run a PowerShell script while already logged into a machine as the user named 'abc' the script runs as the user 'abc'.

The command I am running in cmd is:

powershell pshell.ps1

How can I run a PowerShell script using a particular domain user, other than the currently logged in user?

My intention is to run the PowerShell script through the Windows command line.

回答1:

There are a few ways to run a program or script as another user from within a script:

The built-in command line application RUNAS

The Windows Command Line RUNAS command would look like a good solution to your problem if you were able to specify the credentials.

RUNAS  /user:[e-mail] "powershell pshell.ps1"

As you have said, however, you need to run this task from CONTROL-M, so this is not possible. It is also then not possible to run the task from Task Scheduler as I suggested in a comment and another answer has suggested.

Therefore, my next suggestion is to use a PowerShell script to do this:

The PowerShell scriptlet Invoke-Command

Firstly, you need to enable Win-RM to allow this to work. To do so, type the following in an elevated (i.e. run as administrator) command prompt:

winrm /quickconfig

Next, write a script with the stored credentials you want. Note that this will be stored as plain text, so if you are not willing to do that you will need to look at using a secure credential file.

$username = "DOMAIN\User"
$password = "Password"
$secstr = New-Object -TypeName System.Security.SecureString
$password.ToCharArray() | ForEach-Object {$secstr.AppendChar($_)}
$cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $username, $secstr
Invoke-Command -FilePath "C:\Script\To\Execute.ps1" -Credential $cred -Computer localhost

Naturally, you need to replace C:\Script\To\Execute.ps1 with the file path to your PowerShell script you want to run, and replace DOMAIN\User and Password with the user you want to run as and their password, respectively.

This script will now run as the user specified above.

However, you may be unwilling or unable to use a PowerShell script, and so your last solution rests in a third party application, such as:

SysInternals PsExec

PsExec is a completely free tool offered for download on TechNet specifically designed for running commands, applications, etc. on remote computers. It works perfectly well on the local machine and believe it or not, allows you to specify the specific user (and password!) you want the application to run with.

1. Download and extract the application
2. Put the application somewhere in your PATH attribute (SET PATH=C:\PsExec;%PATH% works, if you installed it to C:\PsExec)
3. Run the command psexec -u DOMAIN\user -p password script.ps1 with the appropriate changes.

回答2:

If you plan on running a batch file that calls a PowerShell script in a scheduled task, you can use the security options of the task scheduler. That's how I would handle running as a different user.

As for calling a PowerShell script from a batch file I usually do something like this:

@ECHO OFF
powershell.exe -executionpolicy unrestricted -File "C:\Scripts\Do-Something.ps1"

You can get all the command line arguments from powershell /?.

You can put that in a .bat file and run that as the scheduled task's action; or you can put powershell.exe as the action and give it the arguments of -executionpolicy unrestricted -File "C:\Scripts\Do-Something.ps1" in the scheduled task. I prefer the latter because I have one less script file to play with.

回答3:

Are you asking if you can bypass the UAC prompt?

IF UAC is enabled, and you start a process that requires elevation from a process that is not elevated (e.g., you are logged on as a standard user), you cannot bypass the UAC prompt. This is by design.