Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a Powershell manteinance script that works this way:

kill explorer
do things
restart explorer

This script executes in elevated mode, but I would need to restart explorer without admin privileges. Any idea?

Thanks

share|improve this question

2 Answers 2

up vote 2 down vote accepted

As far as I know, it's not possible to directly launch a non-elevated process (ie. with a standard low-privilege token) from an elevated process. This isn't a PowerShell limit, it's how UAC in Windows works.

From http://msdn.microsoft.com/en-us/library/windows/desktop/bb756914.aspx:

A frequently asked question is how to launch an un-elevated application from an elevated process, or more fundamentally, how to I launch a process using my un-elevated token once I’m running elevated. Since there is no direct way to do this, the situation can usually be avoided by launching the original application as standard user and only elevating those portions of the application that require administrative rights. This way there is always a non-elevated process that can be used to launch additional applications as the currently logged on desktop user. Sometimes, however, an elevated process needs to get another application running un-elevated. This can be accomplished by using the task scheduler within Windows Vista®. The elevated process can register a task to run as the currently logged on desktop user.

That article mentions two possible solutions:

  1. Run as much of your script in non-elevated mode as possible and only elevate for those parts that need it. In other words, kill and restart explorer in the non-elevated script, and run a second script in elevated mode to "do things":

    Stop-Process -ProcessName explorer
    Start-Process PowerShell.exe -Verb Runas -ArgumentList "-File path_to_script\script.ps1"
    Start-Process explorer.exe
    

    The Runas verb will cause the second PowerShell process to be started in elevated mode. However, this will trigger an UAC prompt, so if this script is to be run fully automated, that's not a good solution.

  2. Create a scheduled task to launch explorer when the elevated operations are done, run the task and delete it. You can use schtasks.exe to do this:

    schtasks /Create /TN "foobar" /TR explorer.exe /SC OnLogon
    schtasks /Run /TN "foobar"
    schtasks /Delete /TN "foobar" /F
    

    Just make sure to choose a name for the task that won't conflict with another.

You can also combine the above two methods, to create a scheduled task to run the second PowerShell script in elevated mode and the rest non-elevated. This has the advantage of not producing an UAC prompt, but introduces the security risk that anyone who has write access to the script can do pretty much anything on your computer. Depending on how exactly you're running and elevating your current script, though, this might be a moot issue.

A third option, if your script is only run by you, is to configure it to start the new explorer.exe process with your credentials:

$Cred = New-Object System.Management.Automation.PSCredential -ArgumentList @("username", (ConvertTo-SecureString -String "password" -AsPlainText -Force))
Start-Process explorer.exe -Credential $Cred

The downside here is having your password stored in the script in plain text. You can also store it in a separate file in encrypted form, by typing the following into a PowerShell prompt:

Read-Host -AsSecureString | ConvertFrom-SecureString | Out-File C:\pw_encrypted.txt

Then type in your password (it'll be shown as asterisks in the PS prompt) and hit Enter. Now you can use it in your script like so:

$Cred = New-Object System.Management.Automation.PSCredential -ArgumentList @("username", (Get-Content C:\pw_encrypted.txt | ConvertTo-SecureString))
Start-Process explorer.exe -Credential $Cred
share|improve this answer
    
Kudos for the complete answer. Thanks! –  rlbisbe Sep 26 '12 at 11:36

The only thing that comes to mind is to use the task scheduler to relaunch explorer. Start-process or any other method seems to maintain the elevated status.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.