8

Is it possible to start a program from Powershell using different Kerberos token for network access from the one used to start the program as you would do using runas /netonly?

1

1 Answer 1

2

PowerShell does have a RunAs option, when you use cmdlets that have it.

For example:

Start-Process

There are several articles that have been around for some time on what you are trying to accomplish. As of course, this query has come up before.

RunAS /netony - PowerShell equivalent ?

# You can't use 'runas' directly in Powershell.  Anyway as you know, Runas will prompt for a password. 

# To run a program with different credentials in Powershell is a two-part process:

# 1. Store the password interactively to an encoded text file:


$credential = Get-Credential 'targetDomain\user'
$credential.Password | ConvertFrom-SecureString | Set-Content c:\scripts\password.txt

Using a PowerShell script to run as a different user & elevate the process.

# The script:

Start-Process powershell.exe -Credential "TestDomain\Me" -NoNewWindow -ArgumentList "Start-Process powershell.exe -Verb runAs"

<#
The following section starts the PowerShell command-line process with Start-Process 
prompting for user credentials. You may not need this dependent on UAC settings, 
as you might already get an over-the-shoulder prompt for creds during elevation. 
#> 

Start-Process powershell.exe -Credential "TestDomain\Me"

# The -NoNewWindow parameter re-uses the same PowerShell command window.

Run a command as a different user in Powershell

There are three main ways to run a command as a different user in Powershell, besides the classing Right click shift. This article will show you how to do that, within the same Powershell session.

Here is a script to download and dissect as needed.

See also:

RunAs 1.3

A version of the Windows 'runas' command that accepts a PSCredential instead of prompting for a password.

Sign up to request clarification or add additional context in comments.

1 Comment

The OP asked specifically about the /netonly parameter of runas. The way /netonly works is that it receives credentials at the time runas is executed. However, those credentials are not validated at this time. Instead, they are applied only when the program that runas launched tries to access the network. This is different from what cmdlets such as Start-Process do when you add a -Credential argument. In this case, the credentials are evaluated immediately. This can cause an authentication failure, and this error can prevent the process from launching.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.