1

I have inherited a legacy Citrix 6.5 system running on Windows Server 2008. Yes I know this stack isn't for server questions but my feeling is that this workstation question as the server is used for running virtual sessions.

The quirk: PowerShell is launched by a normal user without selecting the administrator option:

enter image description here

It launches and briefly shows just "Windows PowerShell" in the title but then somehow switches to "Administrator: Windows PowerShell":

enter image description here

And the shell really is in administrator mode, i.e. I can create files in the C:\Windows folder, e.g. "Hello, World" > C:\Windows\Test.txt

This is a huge security hole esp. as the server is locked down for users as is common in Citrix environments.

I know about Microsoft.PowerShell_profile.ps1 in the documents folder running when PowerShell launches - that's not there. I've also checked the shortcut to check it's not configured to run as administrator - it's not.

Is there another shared PowerShell script run on start-up for everyone? Like a global start-up script? Anything in the registry that might create this?

It's got me stumped!

LATER:

May have found it - all users have been added to the local Administrators group.

  • "Is there another shared PowerShell script run on start-up for everyone?" - There are several PowerShell profiles. Are you by chance logged in as the built-in Administrator on the Server? Be sure you edit your question, instead of responding with a comment, so the entire class can benefit from the additional information. – Ramhound Feb 27 at 10:47
  • if you just run $profile in PowerShell you may get a path returned where the loaded profile is located – SimonS Feb 27 at 10:52
  • Thanks for the heads up on $Profile - that's allowed me to ascertain where PS is looking for the profile script. Not present for the test user I'm looking at – munrobasher Feb 27 at 11:11
  • Ramhound - yes, the administrator is currently logged on to the server in another session. I'll log them off. Aside from the $Profiles folder mentioned above, where else as profiles stored? This is the execution policy: i.imgur.com/tUkcdRv.png – munrobasher Feb 27 at 11:13
  • 1
    Verified: Running PowerShell from Administrator account on WS2008 displays "Administrator:" in the title bar. – harrymc Feb 27 at 19:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.