Sometimes, when I'm teleworking from my personal laptop, I run into problems with my SmartCard reader while trying to connect to systems that are configured to enforce SmartCard usage. The usual workaround, whenever I have elevated privileges on the target system, is to connect to the Remote Registry via regedit and change the scforceoption value.

This works fine when I'm doing it manually via regedit, but navigating down the tree can be rather slow over a VPN connection. I'd like to automate this with a batch or PowerShell script. The problem I run into with this however, is that my laptop is not joined to the same domain as the targets and the targets are not configured to allow PowerShell remoting from my laptop. Changing either of these conditions is not an option.

Since my laptop isn't joined to the domain, and I cannot log on or run commands locally with domain credentials, trying to use reg.exe to connect results in an Access Denied error. Similarly, since the target systems aren't configured to allow PowerShell remoting from my laptop (if at all), Enter-PSSession gives me a "WinRM cannot complete the operation." message.

Is there a work-around I can use to remotely edit a registry, using alternate domain credentials, under these conditions? Or am I stuck with manually digging through the tree, and the associated lag, whenever I need to toggle scforceoption?

I'm aware that I could probably reduce some of the manual work by using a registry import in regedit instead of clicking through the tree, but I'd rather remove the regedit step entirely. My ideal solution would be something I could use to build a script that simply prompts me for the target system name and credentials, then does the rest of the work without any further interaction required.

My laptop is running Windows 8.1 with Update (soon to be Windows 8.1 Pro with Update). Target systems may be running anything from XP/Server 2003 upwards.

1 Answer 1


One option you might be able to use for this is the /netonly switch on runas.

This allows you to launch a command which will use your credentials locally, but whenever it accessess resources over a network it will use the credentials specified in the command.

There's an interesting blog post with some more information and examples here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.