Powershell Start-Process:由于错误而无法执行此命令:访问被拒绝 [英] Powershell Start-Process : This command cannot be executed due to the error: Access is denied

问题描述

我正在尝试使用给定的凭据从Powershell脚本运行启动进程. 但是，该命令失败并显示以下错误:

I'm trying to run start-process from a powershell script with given credential. Nevertheless the command fail with the following error:

Start-Process : This command cannot be executed due to the error: Access is denied  

这是完整的错误日志:

18-Jun-2015 11:48:54    Start-Process : This command cannot be executed due to the error: Access is den
18-Jun-2015 11:48:54    ied.
18-Jun-2015 11:48:54    At C:\Windows\system32\config\systemprofile\AppData\Local\Temp\PRISMA-AMR-JOB1-
18-Jun-2015 11:48:54    87-ScriptBuildTask-8569094554411403512.ps1:38 char:18
18-Jun-2015 11:48:54    +     Start-Process <<<<  C:\Windows\System32\cmd.exe -arg "/C" -Credential $cr
18-Jun-2015 11:48:54    edential
18-Jun-2015 11:48:54        + CategoryInfo          : InvalidOperation: (:) [Start-Process], InvalidOp 
18-Jun-2015 11:48:54       erationException
18-Jun-2015 11:48:54        + FullyQualifiedErrorId : InvalidOperationException,Microsoft.PowerShell.C 
18-Jun-2015 11:48:54       ommands.StartProcessCommand

错误的powershell调用如下所示:

Here is what the the faulty powershell call looks like:

Start-Process C:\Windows\System32\cmd.exe -arg "/C" -Credential $credential

如果在执行脚本的计算机上打开带有适当凭据的命令提示符，则运行cmd /C效果很好.如果它代表启动过程在powershell脚本上运行，则它将失败.

If I open a command prompt with the appropriate credential on the machine where the script is executed, running cmd /C does well. If it's on the powershell script on behalf of start-process it fails.

Maybee我应该说，当我使用目标凭证手动运行命令提示符时，我以管理员身份登录，而Powershell似乎是在系统帐户下运行的.

Maybee I should say that when I manually run the command prompt with targeted credential I was logged as administrator while the powershell looks to be run under the system account.

看起来有些权限确实有问题...知道这里发生了什么吗?

Looks really like something is wrong with some permissions... Any idea what's going on here ?

修改: 从所说的 https://serverfault. com/questions/185813/要允许模拟帐户的广告/193717#193717
我在本地策略"->用户权限分配"中检查了模拟的许可.系统已存在，为了完整起见，我还添加了计算机帐户.重新启动.但是没有运气，问题仍然存在！

From what is been said in https://serverfault.com/questions/185813/which-ad-permission-is-required-to-allow-impersonation-of-an-account/193717#193717
I checked the permission ofr impersonation in Local Policies -> User Rights Assignment. System is present, and for the sake of completeness I also added the computer account. Restarted. But with no luck, problem still there !

推荐答案

好，我终于明白了. 出于安全原因，似乎系统帐户无法启动模拟. 解决方案是将运行脚本的帐户从系统帐户更改为自定义帐户.然后允许在此安全策略中模拟该帐户:

Ok, I finally got it. It seems that for security reason the System account can not initiate impersonation. The solution here was to change the account running the script, from system to a custom account. And then to allow impersonation for this account in security policies as said here:

https://serverfault.com/questions/185813/要允许假冒一个帐户/193717#193717

这篇关于Powershell Start-Process:由于错误而无法执行此命令:访问被拒绝的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！