Powershell脚本由第三方调用，如何硬编码提升的凭据

Question

好的，我理解创建加密凭据并将其存储在powershell脚本中的概念

Powershell如何加密数据库的连接字符串

但是，当第三方程序自动调用powershell脚本时，我如何使其使用提升的凭据运行呢？

以下是当我手动使用"运行方式"时运行得很好的代码，我得到了最后一个登录的用户

$userID=$NULL
$line_array = @()
$multi_array = @()
[hashtable]$my_hash = @{}
foreach ($i in $args){
   $line_array+= $i.split(" ")
}
foreach ($j in $line_array){
    $multi_array += ,@($j.split("="))
}
foreach ($k in $multi_array){
    $my_hash.add($k[0],$k[1])
}
$Sender_IP = $my_hash.Get_Item("sender-ip")


<# Courtesy of http://blogs.technet.com/b/heyscriptingguy/archive/2012/02/19/use-powershell-to-find-last-logon-times-for-virtual-workstations.aspx#>
<#Gather information on the computer corresponding to $Sender_IP#>
$Win32OS = Get-WmiObject -Class Win32_OperatingSystem -ComputerName $Sender_IP
<#Determine the build number#>
$Build = $Win32OS.BuildNumber

<#Running Windows Vista with SP1 and later, i.e. $Build is greater than or equal to 6001#>
if($Build -ge 6001){
    $Win32User = Get-WmiObject -Class Win32_UserProfile -ComputerName $Sender_IP
    $Win32User = $Win32User | Sort-Object -Property LastUseTime -Descending
    $LastUser = $Win32User | Select-Object -First 1
    $UserSID = New-Object System.Security.Principal.SecurityIdentifier($LastUser.SID)
    $userId = $UserSID.Translate([System.Security.Principal.NTAccount])
    $userId = $userId.Value
}
<#Running Windows Vista without SP1 and earlier, i.e $Build is less than or equal to 6000#>
elseif ($Build -le 6000){
    $SysDrv = $Win32OS.SystemDrive
    $SysDrv = $SysDrv.Replace(":","$")
    $ProfDrv = "\" + $Sender_IP + "" + $SysDrv
    $ProfLoc = Join-Path -Path $ProfDrv -ChildPath "Documents and Settings"
    $Profiles = Get-ChildItem -Path $ProfLoc
    $LastProf = $Profiles | ForEach-Object -Process {$_.GetFiles("ntuser.dat.LOG")}
    $LastProf = $LastProf | Sort-Object -Property LastWriteTime -Descending | Select-Object -First 1
    $userId = $LastProf.DirectoryName.Replace("$ProfLoc","").Trim("").ToUpper()
}
else{
    $userId = "Unknown/UserID"
}
if ($userId -ne $NULL){
    "userId=" + $userId
}
elseif ($userID -eq $NULL)
{
    $userId = "Unknown/UserID"
    "userId=" + $userId
}

但是，如果我不使用Run As手动调用powershell，我会得到以下错误

Get-WmiObject : Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
At D:scriptdlp_current_user-UPDATED.ps1:32 char:25
+ $Win32OS = Get-WmiObject <<<<  -Class Win32_OperatingSystem -ComputerName $Sender_IP 
    + CategoryInfo          : NotSpecified: (:) [Get-WmiObject], UnauthorizedAccessException
    + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.GetWmiObjectCommand
You cannot call a method on a null-valued expression.
At D:scriptdlp_current_user-UPDATED.ps1:51 char:30
+     $SysDrv = $SysDrv.Replace <<<< (":","$")
    + CategoryInfo          : InvalidOperation: (Replace:String) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
Get-ChildItem : Cannot find path '\10.1.202.240Documents and Settings' because it does not exist.
At D:scriptdlp_current_user-UPDATED.ps1:54 char:30
+     $Profiles = Get-ChildItem <<<<  -Path $ProfLoc
    + CategoryInfo          : ObjectNotFound: (\10.1.202.240Documents and Settings:String) [Get-ChildItem], ItemNotFoundException
    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetChildItemCommand
You cannot call a method on a null-valued expression.
At D:scriptdlp_current_user-UPDATED.ps1:55 char:65
+     $LastProf = $Profiles | ForEach-Object -Process {$_.GetFiles <<<< ("ntuser.dat.LOG")}
    + CategoryInfo          : InvalidOperation: (GetFiles:String) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
You cannot call a method on a null-valued expression.
At D:scriptdlp_current_user-UPDATED.ps1:57 char:46
+     $userId = $LastProf.DirectoryName.Replace <<<< ("$ProfLoc","").Trim("").ToUpper()
    + CategoryInfo          : InvalidOperation: (Replace:String) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
userId=Unknown/UserID

输出为userId=未知/userId

如何对此进行故障排除？？？

编辑：

所以我试图在调用Get-WmiOjbect时包含-Credential

$cred = Get-Credential -Credential "DomainElevated_Account"
$Win32OS = Get-WmiObject -Class Win32_OperatingSystem -ComputerName $Sender_IP -Credential $cred

现在它提示我输入密码。然而，当我运行脚本时，我会遇到其他错误：

Get-WmiObject : Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
At D:scriptdlp_current_user-UPDATED.ps1:39 char:31
+     $Win32User = Get-WmiObject <<<<  -Class Win32_UserProfile -ComputerName $Sender_IP
    + CategoryInfo          : NotSpecified: (:) [Get-WmiObject], UnauthorizedAccessException
    + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.GetWmiObjectCommand
New-Object : Constructor not found. Cannot find an appropriate constructor for type System.Security.Principal.SecurityIdentifier.
At D:scriptdlp_current_user-UPDATED.ps1:42 char:26
+     $UserSID = New-Object <<<<  System.Security.Principal.SecurityIdentifier($LastUser.SID)
    + CategoryInfo          : ObjectNotFound: (:) [New-Object], PSArgumentException
    + FullyQualifiedErrorId : CannotFindAppropriateCtor,Microsoft.PowerShell.Commands.NewObjectCommand
You cannot call a method on a null-valued expression.
At D:scriptdlp_current_user-UPDATED.ps1:43 char:33
+     $userId = $UserSID.Translate <<<< ([System.Security.Principal.NTAccount])
    + CategoryInfo          : InvalidOperation: (Translate:String) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull

Answer 1

你不能使用启动过程CmdLet:吗

start-process 'c:system32WindowsPowerShellv1.0powershell.exe' -verb runas -argumentlist "-file toto.ps1"

toto.ps1将以提升模式运行。