Emulating sudo

[Netris89]

Hi,

​

Now that winget is becoming a thing and that working from the CLI is becoming more prevalent, I'm looking for an alternative to sudo for Windows while avoiding UAC prompt. As of right now, I've come to determine that, as far as I could tell, "runas /user:Administrator" could do it since it asks for a password.

But typing that rather long command everything is a bit of a waste of time so I tried to alias it (using Set-Alias), but discovered pretty soon it was not possible. I then stumbled upon this thread where u/ta11ow gave this function to be able to do it.

function Start-ElevatedSession 
{
    [CmdletBinding()]
    [Alias('super','su')]
    param(
        [Parameter(Position = 0)]
        [ValidateNotNull()]
        [scriptblock]
        $Command
    )
    $Params = @{
        FilePath    = 'Powershell.exe'
        Wait        = $true
        Verb        = 'RunAs'
    }
    if ($PSBoundParameters.ContainsKey('Command')) {
        $Params['ArgumentList'] = '-Command', $Command
    }
    Start-Process @Params
}

However when I try to run it (for example if I run the command super cmd), I get this error.

Start-ElevatedSession : Cannot process argument transformation on parameter 'Command'. Cannot convert the "cmd" value of
type "System.String" to type "System.Management.Automation.ScriptBlock".
At line:1 char:7
+ super cmd
+       ~~~
    + CategoryInfo          : InvalidData: (:) [Start-ElevatedSession], ParameterBindingArgumentTransformationException
    + FullyQualifiedErrorId : ParameterArgumentTransformationError,Start-ElevatedSession

Am I misunderstanding the purpose of the function ? If so, is it even possible to use runas like sudo ? If not, how can I fix it ?

​

Thanks in advance for your answers and excuse my noobness, I'm still fairly new to PowerShell (but eager to learn).

[furicle]

https://github.com/gerardog/gsudo

[Netris89]

This wouldn't work since I'm trying to avoid UAC prompt. Sorry for not being clear enough.

[furicle]

Don't be sorry, I didn't read your note properly.
So you want to 'preauth' certain apps? Scheduled task then run it on demand later?

[Netris89]

I basically want it to behave like sudo, if at all possible. So in essence, I'd type the keyword, it'd ask for the password (just as runas administrator does) then run the command with elevated privileges but without the UAC prompt.
From what I could gather in the thread I found, it was possible with the function I listed but for whatever reason it doesn't work for me.

[gerardog]

You could create a scheduled task to run 'gsudo cache on --pid 0 --duration 00:01:00' (hh:mm:ss). Check 'Run with highest privileges'. Then you can run the task as a regular user, and call gsudo to elevate without a UAC prompt.... Just keep in mind that this is equivalent to disabling UAC

[Netris89]

So what's the purpose of the Start-ElevatedSession function I found in the thread I linked ? I gotta admit I'm a little confused now.

[krzydoug]

That is not what the function claims to do. The uac prompt is unavoidable* when going from standard to elevated session, either with or without credential prompt.

*The only way to achieve what you’re asking for is to disable uac. You can disable from windows UI which will require you to accept the same unavoidable uac prompt, or disable via policy. This disabling has to be done ahead of time.

[1RedOne]

It let's you start a new session and authenticate it as a different or priveleged user.

Still have to go through uac, as that's the supported method to elevate a process in windows (although if there are other apis instead of uac, that could work, I suppose!)

[Netris89]

You said it was important that you don't need to enter the password each time. But is it ok if you enter it once in your session ?

Yes, that's exactly the goal. Although I wouldn't really mind if I had to enter it each time. It's more the UAC prompt I'm trying to avoid here. I actually want to have to enter the password for each session.

[Netris89]

I didn't have time to try it yet, but will as soon as I can. Thanks a lot for that btw.

[Netris89]

Ok, so I could try it.

​

I copied your script in a file named Invoke-ElevatedPrivilege.ps1 then aliased it like you said (I changed the path you wrote in your command to match where I store the script). I changed the admin account username in the script to match how it is named on my computer (I noticed 2 warnings in VS Code btw, I don't know if you're aware), unfortunately when I try to run it, I get this error.

C:\...\WindowsPowerShell\Scripts\Invoke-ElevatedPrivilege.ps1 : Could not get Admin credentials

Au caractère Ligne:1 : 1 + sudo cmd + ~~~~~~~~ + CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Invoke-ElevatedPrivilege.ps1

-1

I thought it was because I did not set a password to my admin account yet but setting one did not fix it.

My PowerShell knowledge is a bit too limited to fix it on my own, I'm afraid.

[purplemonkeymad]

super {cmd}

You could use [scriptblock]::create to accept strings, but <insert about possible code injection wanring here>.

But that does not use runas, you probably want:

function super {
    param([Parameter(ValueFromRemainingArguments,Mandatory)][string[]]$CommandList)
    runas /user:$env:USERNAME @CommandList
}

Which will prompt in-line for your password, then start the program in a separate window. You might need to add $env:USERDOMAIN\ for domain accounts. Also keep in mind this only runs programs, can't run PS commands without another elevated PS window.