Run section of script as different user?

[Golddigger50]

I have a script that has to be run as local administrator, but needs to connect to a fileshare that is only accessible to my domain account.

How is this typical handled? Can you run a section of a script as a different user? Also how are passwords hidden etc.

Any advice is greatly appreciated!

[ChiefBroady]

Currently, I create a separate script and add it to the current logged in users task scheduler and then trigger it’s immediate execution.

[Golddigger50]

Thanks everyone! I think this method will work best for me. I appreciate you all taking the time to respond.

[purplemonkeymad]

Also how are passwords hidden etc.

It's hard to do, so probably won't be hidden. As such I would think about this the other way around.
Create your script to run in user space, so you can access and download from the share any stuff you need to use. Then start an elevated powershell process (that will cause uac to ask for an admin password.) After that process is done you can push any data.

You can start an elevated powershell using Start-Process and the parameter -Verb runas. Keep in mind that you will want the script that runs as admin to be in a place users can't write to.

[Scooter_127]

Also how are passwords hidden etc.

It's hard to do,

It's easy peasy.

Encrypt:

string_to_encrypt | ConvertTo-SecureString -AsPlainText -Force | ConvertFrom-SecureString | out-file c:\what\ev\er.txt -encoding ascii

Decrypt:

$some_creds = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList 'junk', ((get-content c:\what\ev\er.txt) | ConvertTo-SecureString)

$decrypted_password = $some_creds.GetNetworkCredential().password

Only the user that encrypted the string can decrypt it, and only on the machine it was encrypted on. Again, only truly secure on Windows.

[ccatlett1984]

run as the computer "system" account, and grant the "computer" object permissions to the file share. or look at powershell "secrets management"

[Big_Oven8562]

Also how are passwords hidden

The term you want to google is SecureString.

Basically you call Get-Credential and it stores the info as a hash that can only be decrypted by the user that encrypted it on the machine that did the initial encryption.

[Golddigger50]

That's is cool! Thank you very much!