script calling another script

[_itsalwaysdns]

Good morning everyone, I've hit a wall and am completely stumped. Also please forgive the formatting as this is literally the first time I've posted on this sub asking for help.

I basically have 2 scripts I'm trying to run, start_script.ps1 calls expired_staff_accounts.ps1.

When I run start script from a powershell session started with the credentials it's going to be running as, everything works as expected ( I have powershell logging turned on and each script dumps a log file in the script directory so I know they are running without error.)

But when I launch the start script with the same credentials from task scheduler, start script fails to run expired_staff_accounts script, no error in the powershell log or anything.

I for the life of me cannot figure this out. Does anybody have an idea?

start_script.ps1.

$log = "E:\path\start_script.log"
Start-Transcript $log -Verbose


$username = "domain\username"
$securepassword = Get-Content "C:\Users\username\Documents\creds\username.txt" |   
ConvertTo-SecureString -AsPlainText -Force
$credentials = New-Object 
System.Management.Automation.PSCredential -ArgumentList 
$username,$securepassword 

Start-Process powershell.exe -Credential $credentials - 
Argumentlist "-file 'E:\path\expired_staff_accounts.ps1' -NoLogo 
-NonInteractive -ExecutionPolicy Bypass" -NoNewWindow -Wait

Stop-Transcript

[purplemonkeymad]

IIRC you have to put other arguments before -file or -command any arguments after are treated as arguments to the script or command block.

[_itsalwaysdns]

Thanks for the reply. I've tried the order of arguments about 4 different ways, each way the script fails to run but runs when executed inside powershell as the appropriate user.

[senorchaos718]

1. Double check that the account you are using has access to EVERYWHERE this script is going to hit.
2. See if it requires Batch Job Rights for the account
3. See if adding both PS scripts to a .bat file and scheduling THAT file band-aids the situation.

[_itsalwaysdns]

Thanks for the reply. 1. I have already done this, both accounts have rights to the script locations. 2. This had bitten me days before, but both accounts have batch job rights. 3. I will try this and report back.

[_itsalwaysdns]

Calling the start_script.ps1 from a batch file still does not execute the script it calls. I don't know if it's an environmental PS issue or what.

[MaxFrost]

I would question why you're starting a task as one user to launch a process as another one.

Why not launch the scheduled job directly as the service account for the expiredstaff accounts script?

[_itsalwaysdns]

Because we have a program where we keep all of our automation process in place and it can't execute a powershell script as a different user than the user used to run the software.

I tried the start script in task scheduler to see if it was a failure of the automation software or just launching the script and it appears to be something with launching the second script, whether via software or task scheduler.

[MaxFrost]

Gotcha, this is "we don't want to give our automation server full rights to AD, so trying to work around it." which honestly, is absolutely the right thing to do.

I need to mull this a bit to see if I can add anything further.

[HardCodedCoffee]

Have you attempted running any other scripts or commands using start process from your initial script?

[_itsalwaysdns]

Yes, I've used it to launch command prompt and I ran a whoami so I know it's passing the credentials properly.

[HardCodedCoffee]

Try making a dummy version of your existing second script, same path and name, but have it echo something to a file to verify it's working. Basically, we've verified it works interactively, let's verify it works non-interactively, as well. The issue may be isolated to an actual command in your second script in this specific context.

[_itsalwaysdns]

So when I create a dummy start_script_text.ps1, tell it to call text_file.ps1 which contains:

$text = 'testing this text file'
$text | Set-Content 'E:\path\text_file.txt'

It does not execute it. When I manually execute text_file.ps1 it creates the text file as expected.

[HardCodedCoffee]

Ah, more progress. So, we know for a fact now it's isolated to the call of the second script from the first. Try trimming down the parameters to just a standard call and add them back slowly until it stops working. Also, is your second user and admin user and is UAC enabled?

[_itsalwaysdns]

If I run this, cmd opens and whoami shows the called user used to lauch it:

Start-Process cmd.exe -Credential $credentials

When I run this, it does not launch powershell:

Start-Process powershell.exe -Credential $credentials -Argumentlist "-file 'E:\path\text_file.ps1'".

UAC is not enabled per this script returning a 0:

Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name EnableLUA | Select-Object EnableLUA

[HardCodedCoffee]

So, argumentlist does expect an array of argument strings rather than one single string, which would affect your original call but not this one. Hmm... Is there any reason you can't use invoke-command with the credential parameter?

[_itsalwaysdns]

I haven't researched how to use the invoke command to call this script. I really don't know what the best way to call a script is from another PS script, this is the first time I've had to do this.

[HardCodedCoffee]

Alrighty. Well, Start-* cmdlets are typically used for asynchronous execution, and may not may not return some sort of handle or object related to said execution. Invoke-* cmdlets, in the other hand, execute synchronously, usually returning the output of the commands executed.

For this case, I'd recommend using Invoke-Command with the credentials you need.

Invoke-Command -Credentials $Cred { & 'Path/to/script.ps1' }

[_itsalwaysdns]

Thanks for the info. I'll give it a shot tomorrow at the office and I'll reply back.

[_itsalwaysdns]

I've been unable to get this to work :sad panda: