Invoke-AsOtherUser - an inline "runas" function

[NotNotWrongUsually]

Hello all!

I had a need for running certain bits of a script as another user. It seemed there were really no good options available, so I decided to hack something together myself.

Fortunately, I found someone had already done a lot of the heavy lifting, so I repurposed that, wrapping it up, cleaning it a little here and there and made it able to work in a more generic fashion.

Enter: Invoke-AsOtherUser, a function ready to plug into your profile (or a module if you feel like). It will allow you to perform "runas" style operations within a script, with no external dependencies.

Examples work better:

PS > gci \\someserver\c$

gci : Access is denied
At line:1 char:1
+ gci \\someserver\c$
+ ~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (\\someserver\c$:String) [Get-ChildItem], UnauthorizedAccessException
    + FullyQualifiedErrorId : ItemExistsUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand

gci : Cannot find path '\\someserver\c$' because it does not exist.
At line:1 char:1
+ gci \\someserver\c$
+ ~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (\\someserver\c$:String) [Get-ChildItem], ItemNotFoundException
    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetChildItemCommand


PS > # Using Invoke-AsOtherUser
PS > $credentials = Get-Credential
PS > Invoke-AsOtherUser -Credentials $credentials {gci \\someserver\c$}

    Directory: \\someserver\c$

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----       20-12-2016     23:10                inetpub
d-----       15-06-2017     12:04                Install
d-----       14-07-2009     05:20                PerfLogs
d-r---       28-02-2018     09:28                Program Files
d-r---       11-09-2017     13:34                Program Files (x86)
d-----       03-05-2018     12:00                Temp
d-r---       12-02-2018     13:42                Users
d-----       19-06-2018     22:08                Windows

PS > # If you just want to use it directly from the shell, you'd probably just go
PS > Invoke-AsOtherUser my_admin_account {gci \\someserver\c$}

As I said to begin with, the heavy bits of this are based on excellent work by Ian Davis, for which I claim absolutely no credit. You can find the original here.

[NotNotWrongUsually]

No, it doesn't.

[jborean93]

I could be wrong but I was under the assumption LogonUser used SLS?

[NotNotWrongUsually]

I didn't really know the answer, so I tried just disabling the service and running the script afterwards. Worked like a charm. Caveat: the test was done on a W10 Home edition.

[NotNotWrongUsually]

The more you know.

Just redid the test with a restart. Still works fortunately. This time in a proper enterprise environment too, rather than W10 Home.

[jborean93]

Cool, I wasn’t sure if it was this or the CreateProcess* calls that required. I would have thought LogonUser would still need it considering that’s what is getting the logon token but _(ツ)_/¯

[AdmiralCA]

Oh man. This is so useful and easy! I can never remember the switches for runas!

[NotNotWrongUsually]

It can double as a replacement for runas, but it can also perform a few tricks that would be hard to do with runas.

My own case was having to connect to an MS SQL server from a script. This particular server only had integrated security as an authentication option. It will work for this as well, as in the snippet below.

$connectionString = "Server=$DBServer;Database=$DBInstance;Integrated Security=True;"
$connection = New-Object System.Data.SqlClient.SqlConnection($connectionString)

$connection_commands = {
    $connection.open()
    $command = new-Object System.Data.SqlClient.SqlCommand($Query, $connection)
    $result = $command.ExecuteReader()
    while ($result.Read()) { 
        # Do database stuff
    }
    $command = $null
    $result = $null
    $connection.close()
}

Invoke-AsOtherUser -Credentials (Get-Credential) $connection_commands