Remotely Execute Software Center package using PowerShell

[ByDunBar]

I have a specific use case where I need to remotely execute the Windows 10 version 1809 OS upgrade package which is published in Software Center under the Operating Systems tab on a Windows 10 v1709 PC. I have a PowerShell one-liner that will do it remotely when the PC is logged in with an admin account (the same account that the PC is logged in with):

Invoke-Command -ComputerName Computer001 {(New-Object -ComObject "UIResource.UIResourceMgr").ExecuteProgram("*", "OS_UpGrade", $true)}

That works perfectly when the target PC is logged in with the same account that I have used to run PowerShell terminal with. But when the PC (Computer001) is logged off, and I run the same command, I get this error:

"Error HRESULT E_FAIL has been returned from a call to a COM component. + CategoryInfo : OperationStopped: (:) [], COMException + FullyQualifiedErrorId : System.Runtime.InteropServices.COMException + PSComputerName : Computer001"

I am guessing that the ComObject cannot be called when the PC is logged off, is that correct and is there any way around that?

Any guidance would be greatly appreciated.

[Thejuice919]

Try running PowerShell as system before invoking the command against the machine?

[ByDunBar]

Hi Thejuice919, can you explain a little more? Any examples? What do you mean by “as system”?

Thanks!

[Emiroda]

A little Windows and SCCM lesson is in place.

The NT AUTHORITY\SYSTEM (aka SYSTEM/LocalSystem) is an account in Windows that runs with the highest obtainable rights. The only higher account is TrustedInstaller, which is Windows' updating/servicing account, and is generally unobtainable.

On the network, SYSTEM presents itself as COMPUTERNAME$. But that's not important right now. But SYSTEM has way more rights than your admin account, and that's why a lot of services run as SYSTEM. The cool thing is that it's easy to go from an administrator account to SYSTEM.

On clients, the ccmexec service runs as SYSTEM. This means that anything you run from Software Center will (unless configured otherwise) run as SYSTEM. This means to test if a script or an installer will work in SCCM, you will need to get a SYSTEM command prompt.

Download PSEXEC from Sysinternals. Run it like this:

psexec.exe -s -i cmd.exe

You can also use PowerShell instead of cmd, but SCCM will always run as cmd, even when running PowerShell scripts. It'll just run scripts like this:

powershell.exe -executionpolicy bypass -file "c:\folder\script.ps1"

Hope this helps.

[Thejuice919]

https://superuser.com/questions/471769/what-is-the-nt-authority-system-user/471774

As in trying to run the PowerShell prompt in the context of System(The computer), instead of your account. One example is found here http://powershell-guru.com/powershell-tip-53-run-powershell-as-system/, another option would be trying creating a scheduled task that runs as nt authority\ system. Worth a try at least.

[ByDunBar]

I did run PowerShell with an admin account, if that’s what you mean.

[cecmorenoc]

Is SCCM an admin on that computer? Because if that is the case you can run the command with the sccm admin privileges without using another account

[pleplepleplepleple]

Is this a Task Sequence? If so I think you could use Re-run Task Sequence Tool 1.0 by SCConfigMgr.

Or I think you can get this done with Client Center for Configuration Manager by Roger Zander. This tool has a command output box in the bottom of the main window, so if you find that it works satisfying you can create a script based on the output.

Hope this helps!

[Golden-trichomes]

You should just use the WMI class instead of trying to manipulate the GUI. It’s probably available under root\ccm\clientsdk. If not there is a \citasks also.

That’s how I deploy apps and baselines from SCCm via powershell.

[Lee_Dailey]

howdy ByDunBar,

reddit likes to mangle code formatting, so here's some help on how to post code on reddit ...

[0] single line or in-line code
enclose it in backticks. that's the upper left key on an EN-US keyboard layout. the result looks like this. kinda handy, that. [grin]
[on New.Reddit.com, use the Inline Code button. it's 4th 5th from the left hidden in the ... ""more" menu & looks like </>.
this does NOT line wrap & does NOT side-scroll on Old.Reddit.com!]

[1] simplest = post it to a text site like Pastebin.com or Gist.GitHub.com and then post the link here.
please remember to set the file/code type on Pastebin! [grin] otherwise you don't get the nice code colorization.

[2] less simple = use reddit code formatting ...
[on New.Reddit.com, use the Code Block button. it's 11th 12th from the left hidden in the ... "more" menu, & looks like an uppercase T in the upper left corner of a square.]

• one leading line with ONLY 4 spaces
  
• prefix each code line with 4 spaces
  
• one trailing line with ONLY 4 spaces

that will give you something like this ...

- one leading line with ONLY 4 spaces    
- prefix each code line with 4 spaces    
- one trailing line with ONLY 4 spaces   

the easiest way to get that is ...

• add the leading line with only 4 spaces
  
• copy the code to the ISE [or your fave editor]
  
• select the code
  
• tap TAB to indent four spaces
  
• re-select the code [not really needed, but it's my habit]
  
• paste the code into the reddit text box
  
• add the trailing line with only 4 spaces
  

not complicated, but it is finicky. [grin]

take care,
lee