Question:
Using powershell.exe, I want to emulate cmd.exe‘s runas command with the additional benefit of escalating privileges through UAC.
However, if I both supply both -Credential and -Verb Runas parameters to Start-Process, I get the error below:
|
1 2 3 4 5 6 7 8 9 |
Start-Process powershell.exe -Credential (New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList 'username',(ConvertTo-SecureString 'password' -AsPlainText -Force)) -ArgumentList '-NoProfile' -Verb RunAs Start-Process : Parameter set cannot be resolved using the specified named parameters. At line:1 char:1 + Start-Process powershell.exe -Credential (New-Object -TypeName System ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidArgument: (:) [Start-Process], ParameterBindingException + FullyQualifiedErrorId : AmbiguousParameterSet,Microsoft.PowerShell.Commands.StartProcessCommand |
Using only one of these parameters yields no errors:
|
1 2 |
Start-Process -Verb RunAs powershell.exe -ArgumentList "-NoProfile" |
Why is that? Both syntax forms of Start-Process accept [<CommonParameters>], which -Verb Runas belongs to?
Answer:
The -Verb parameter is only available in one of the parameter sets (if you do Get-Help Start-Process you can see it explictly listed in the second set):
|
1 2 3 4 5 6 |
SYNTAX Start-Process [-FilePath] [ Start-Process [-FilePath] |
It’s not a part of CommonParameters, that just includes things like -Debug, -Verbose, -ErrorAction etc. (see the full list here).
This seems to be a possible workaround:
|
1 2 |
Start-Process powershell -Credential mydomain\myuser -ArgumentList '-noprofile -command &{Start-Process powershell -verb runas}' |