Source
r/PowerShell•
KeystrokeCowboy

Invoke Command question

I'm running into what I believe is a simple problem but the solution so far escapes me. I'm trying to run an exe on a list of computers. To do this I am using Invoke Command -scriptblock {script}

But the executable will run, then fail every single time due to permissions. If I run the command locally in an administrative session, it will work. So it seems like I need open cmd.exe as admin first and then run the original command. I'm not sure how to Invoke-Command on a remote machine to open up cmd.exe as admin then run the original .exe I want. As I understood it, the invoke command uses the session credentials by default if not added with -Credentials. Even if I specifically give my credentials, it still fails. Any ideas?

Posted Sep 14, 2020, 5:05 PM UTC

37
klutch2013•

You must likely need the -Credential <username> on the invoke-command. TheInvoke-Command docs has a few examples. I also found this StackExchange article talking about it.

I just noticed you saying -credential didn't work. You want to try Enter-PsSession with your -Credential.

2
KeystrokeCowboyOP•

I've done that as well. Created a new PS-Session and used the session as part of Invoke-Command -Session $Session

2
PaladinInc•

You can elevate with Start-Process:

Start-Process powershell -Verb runAs -ArgumentList $arguments
1
KeystrokeCowboyOP•

Start-Process powershell -Verb runAs -ArgumentList $arguments

I did try this as well.

Invoke-Command -ComputerName $Server -Scriptblock {Start-Process powershell -Verb runAs -ArgumentList $using:Arguments}

I run this and nothing happened. If I run just the start process part of the script. It will run and work. I tried running it with the verbose switch for Invoke-Command hoping I would see an error but nothing.

1
PaladinInc•

Ah, right, that makes sense.

Your best bet looks like the second answer given here: https://serverfault.com/questions/496410/how-do-i-run-commands-on-a-remote-machine-with-admin-privilege-using-powershell

I haven't tried it so I don't know if it actually works or not.

1
KeystrokeCowboyOP•

This article isn't telling me anything new and I feel like it's putting me back where I started.

$Server = "Server01"
$Arguments = 'C:\windows\system32\spool\tools\PrintBrm.exe -B -F'+'"'+'\\folderpath\' + $Server + '.printerExport"'
Invoke-Command -Scriptblock {Start-Process powershell -Verb runAs -ArgumentList $Arguments}

​

This works locally from an ISE console as administrator to backup local printers to a network share. But I can never get this to work remotely on another machine. If I first enter a PS-Session for the remote machine and then run the invoke-command in that session, it will generate a permission error in the event log on the remote server. Even if I specifically use -credentials $creds and put my credentials into the variable. There is some permissions issue going on and I cannot get past getting this code to run something as admin. If I start powershell as admin it will work locally, but I can't force an admin session on a remote computer for some reason. -Verb runAs is supposed to do that, but doesn't....

1
PaladinInc•

It may just not be possible to do what you want to do with Invoke-Command. Have you considered using PsExec instead? Specifically with the '-h' option to run elevated.

2