How PowerShell allows ordinary users to execute programs with administrator privileges

The client management of Windows often comes across a scenario in which users need to upgrade a certain software, but administrator privileges are required. If they are programs that are not released through group policy or SCCM, desktop support needs to go there in person and enter the administrator user and password to upgrade privileges.

So how can the average user be able to execute a program with administrator privileges?

The easiest way is to create a shortcut, specify the administrator account and password of runas on the path, and the path of the file can be executed. However, this disadvantage is that password accounts are displayed in clear text, and users can see it if they are a little smarter. The solution is simple: the operation of runas is implemented in a script and then compiled into an exe file to hide the source code.

Here's a simple example. I want to open teamviewer with administrator privileges.

Write a script, t2.ps1.

You can see that passwords and users are displayed in clear text.

$secpasswd = ConvertTo-SecureString 'Pa$$word'-AsPlainText-Force$mycreds = New-Object System.Management.Automation.PSCredential ("administrator", $secpasswd) Start-Process "C:\ Program Files (x86)\ TeamViewer\ TeamViewer.exe"-Credential $mycreds

The next step is to compile to exe. It needs to be explained here that powershell can not really 'compile' into exe, its essence is to compress the shell of exe after processing. You can usually compile with PowerGui, but I don't bother to download and install such a large software. I can do it directly with Powershell scripts. The script for this PowerShell has been written. Download the link https://gallery.technet.microsoft.com/scriptcenter/PS2EXE-GUI-Convert-e7cb69d5.

There are ready-made examples in the download completion. To save trouble, I dragged my t2.ps1 directly to the Examples directory

Modify BuildExamples.ps1, specify directory and icon

$SCRIPTPATH = Split-Path $SCRIPT:MyInvocation.MyCommand.Path-parentls "$SCRIPTPATH\ Examples\ * .ps1" |% {. "$SCRIPTPATH\ ps2exe.ps1"$($_ .Fullname)"$($_ .Fullname-replace '.ps1', '.exe')"-verbose-iconfile "PSEXE.ico". "$SCRIPTPATH\ ps2exe.ps1"$($_ .Fullname)"$($_ .Fullname-replace '.ps1") '- GUI.exe') "- verbose-noConsole} Remove-Item" $SCRIPTPATH\ Examples\ Progress.exe* "Remove-Item" $SCRIPTPATH\ Examples\ ScreenBuffer-GUI.exe* "$NULL = Read-Host" Press enter to exit "

Then execute the BuildExamples.bat file, which automatically compiles the ps1 file to the exe file, plus the specified ICON

Double-click my t2.exe and he will open teamviewer automatically.

Check that the process is indeed executed by administrator

Problem solving