blocks|key|227604|text|在start-process中存在交换机runas类|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|227605|start-process+powershell+-verb+runAs|code-block|syntax|javascript|227606|但是，uac仍然检查您是否应该先绕过+uac+，有很多方法可以绕过uac，但是并不是所有的窗口都能工作，比如windows+8，如果您为运行进程编写脚本，那么编译为exe就可以使用像拉纳斯管理这样的程序在系统中作为管理程序运行，但在windows+8中仍然不能工作。|BOLD|227607|entityMap|0|LINK|mutability|MUTABLE|url|https://ps2exe.codeplex.com/|1|https://level-23.eu/forum/showthread.php?t=32278^0|1|D|K|5|0|0|I|5|27|6|0|2J|5|1|0^^$0|@$1|2|3|4|5|6|7|X|8|@$9|Y|A|Z|B|C]|$9|10|A|11|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|12|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|13|8|@$9|14|A|15|B|M]]|D|@$9|16|A|17|1|18]|$9|19|A|1A|1|1B]]|E|$]]|$1|N|3|-4|5|6|7|1C|8|@]|D|@]|E|$]]]|O|$P|$5|Q|R|S|E|$T|U]]|V|$5|Q|R|S|E|$T|W]]]]

in <code>start-process</code> exist switch <code>runas</code> like

<pre><code>start-process powershell -verb runAs
</code></pre>

but still uac check you if in your system uac on you should first bypass uac there are many way exist for bypass uac but all ways doesn't work in all windows like windows 8
if you write script for run process then <a href="https://ps2exe.codeplex.com" rel="nofollow">compile to exe</a> you can use program like <a href="https://level-23.eu/forum/showthread.php?t=32278" rel="nofollow">runasadmin</a> for run as admin your exe in system but still not work in windows 8

blocks|key|227666|text|可以使用TrustLevel指定runas.exe，从而有效地运行“受限”。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|227667|runas+/trustlevel:0x20000+"powershell.exe+-command+'whoami+/groups+%7Cclip'"|code-block|syntax|javascript|227668|您应该在whoami的输出中看到令牌中的Administrators组被标记为“仅用于拒绝”。|227669|​|227670|📷|atomic|227671|227672|entityMap|0|IMAGE|mutability|IMMUTABLE|imageUrl|https://developer.qcloudimg.com/http-save/yehe-900000/5530e7b9778328e1bff66f1f2db9b0a5.png|imageAlt^0|4|A|G|9|0|0|4|6|K|E|0|0|0|1|0|0|0^^$0|@$1|2|3|4|5|6|7|11|8|@$9|12|A|13|B|C]|$9|14|A|15|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|16|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|17|8|@$9|18|A|19|B|C]|$9|1A|A|1B|B|C]]|D|@]|E|$]]|$1|M|3|N|5|6|7|1C|8|@]|D|@]|E|$]]|$1|O|3|P|5|Q|7|1D|8|@]|D|@$9|1E|A|1F|1|1G]]|E|$]]|$1|R|3|N|5|6|7|1H|8|@]|D|@]|E|$]]|$1|S|3|-4|5|6|7|1I|8|@]|D|@]|E|$]]]|T|$U|$5|V|W|X|E|$Y|Z|10|-4]]]]

You can specify the <code>TrustLevel</code> with <code>runas.exe</code>, effectively running "restricted"

<pre><code>runas /trustlevel:0x20000 "powershell.exe -command 'whoami /groups |clip'"
</code></pre>

You should see in the output from <code>whoami</code> that the <code>Administrators</code> group in your token is marked as "Used for Deny only"

<hr>

<img src="https://i.stack.imgur.com/AJm5B.png" alt="enter image description here">

blocks|key|1273224|text|当您深入研究这个问题时，正如链接任务所提到的，无法从提升的进程运行UAC“非”提升进程。由于这正是我所需要的，而且runas解决方案对我不起作用，所以我将Microsoft提供的代码解决方案转换为使用预定任务启动“非”提升的进程。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1273225|从提升的powershell提示符中将powershell.exe作为“非”提升进程运行的示例：|1273226|$apppath+=+"powershell.exe"
$taskname+=+"Launch+$apppath"
$action+=+New-ScheduledTaskAction+-Execute+$apppath
$trigger+=+New-ScheduledTaskTrigger+-Once+-At+(Get-Date)
Register-ScheduledTask+-Action+$action+-Trigger+$trigger+-TaskName+$taskname+%7C+Out-Null
Start-ScheduledTask+-TaskName+$taskname
Start-Sleep+-s+1
Unregister-ScheduledTask+-TaskName+$taskname+-Confirm:$false|code-block|syntax|javascript|1273227|上述powershell命令仅适用于Windows+2012+/+Windows+8及更高版本。|1273228|或者您可以使用SCHTASKS.EXE应用程序来覆盖大多数版本的windows：|offset|length|1273229|$apppath+=+"powershell.exe"
$taskname+=+"Launch+$apppath"
schtasks+/create+/SC+ONCE+/ST+23:59+/TN+$taskname+/TR+$apppath
schtasks+/run+/tn+$taskname
Start-Sleep+-s+1
schtasks+/delete+/tn+$taskname+/F|1273230|entityMap|0|LINK|mutability|MUTABLE|url|https://msdn.microsoft.com/en-us/library/windows/desktop/bb736357%2528v=vs.85%2529.aspx^0|0|0|0|0|7|C|0|0|0^^$0|@$1|2|3|4|5|6|7|Y|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Z|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|10|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|11|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|12|8|@]|9|@$M|13|N|14|1|15]]|A|$]]|$1|O|3|P|5|F|7|16|8|@]|9|@]|A|$G|H]]|$1|Q|3|-4|5|6|7|17|8|@]|9|@]|A|$]]]|R|$S|$5|T|U|V|A|$W|X]]]]

When you dig into this problem, as mentioned by the linked tasks, there is no way to run a UAC "non" elevated process from a elevated process. Since this is exactly what I required and the runas solution didn't work for me I converted the code workaround supplied by Microsoft to use a scheduled task to Start a "non" elevated process.

Example of running powershell.exe as a "non" elevated process from a elevated powershell prompt:

<pre><code>$apppath = "powershell.exe"
$taskname = "Launch $apppath"
$action = New-ScheduledTaskAction -Execute $apppath
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date)
Register-ScheduledTask -Action $action -Trigger $trigger -TaskName $taskname | Out-Null
Start-ScheduledTask -TaskName $taskname
Start-Sleep -s 1
Unregister-ScheduledTask -TaskName $taskname -Confirm:$false
</code></pre>

The above powershell commands only work on Windows Server 2012 / Windows 8 and greater only.

Or you can use the <a href="https://msdn.microsoft.com/en-us/library/windows/desktop/bb736357%28v=vs.85%29.aspx" rel="nofollow noreferrer">SCHTASKS.EXE</a> application instead to cover most versions of windows:

<pre><code>$apppath = "powershell.exe"
$taskname = "Launch $apppath"
schtasks /create /SC ONCE /ST 23:59 /TN $taskname /TR $apppath
schtasks /run /tn $taskname
Start-Sleep -s 1
schtasks /delete /tn $taskname /F
</code></pre>

blocks|key|227765|text|另一种有限的方式:让Windows资源管理器为您启动它|type|unstyled|depth|inlineStyleRanges|entityRanges|data|227766|PS+C:\>+explorer.exe+"C:\windows\system32\cmd.exe"|code-block|syntax|javascript|227767|只需使用完整的路径和扩展即可。但是它不接受参数。|offset|length|style|BOLD|227768|我试着创建一个批处理文件。但探险家拒绝推出.BAT或.CMD。|CODE|227769|entityMap^0|0|0|H|4|0|L|4|Q|4|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|S|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|T|8|@$I|U|J|V|K|L]]|9|@]|A|$]]|$1|M|3|N|5|6|7|W|8|@$I|X|J|Y|K|O]|$I|Z|J|10|K|O]]|9|@]|A|$]]|$1|P|3|-4|5|6|7|11|8|@]|9|@]|A|$]]]|Q|$]]

Another, limited, way: Make Windows Explorer launch it for you

<pre><code>PS C:\&gt; explorer.exe "C:\windows\system32\cmd.exe"
</code></pre>

Just use the full path and extension. But it does NOT accept parameters. 

I tried creating a batch file. But explorer refuses to launch <code>.BAT</code> or <code>.CMD</code>.

blocks|key|227782|text|您可以通过传递要运行的用户的凭据，从提升的会话中运行非管理进程。如果希望以交互方式运行，可以使用Get-Credential；如果希望脚本无人参与运行，则可以使用Import-Clixml或SecretStore或其他已建立的机制来存储和检索凭据。例如：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|227783|$credential+=+Get-Credential+-UserName+$Env:USERNAME
#+or
$credential+=+Import-Clixml+-Path+'C:\MyCredential.cred'

Start-Process+-FilePath+pwsh.exe+-ArgumentList+'-noprofile'+-Credential+$credential+-Wait|code-block|syntax|javascript|227784|entityMap|0|LINK|mutability|MUTABLE|url|https://devblogs.microsoft.com/powershell/secretmanagement-and-secretstore-are-generally-available/^0|1C|E|29|D|2N|B|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@$9|T|A|U|B|C]|$9|V|A|W|B|C]]|D|@$9|X|A|Y|1|Z]]|E|$]]|$1|F|3|G|5|H|7|10|8|@]|D|@]|E|$I|J]]|$1|K|3|-4|5|6|7|11|8|@]|D|@]|E|$]]]|L|$M|$5|N|O|P|E|$Q|R]]]]

You can run a non-admin process from an elevated session by passing in the credential of the user you want to run as. You can use <code>Get-Credential</code> if you want to run interactively, or you can use <code>Import-Clixml</code> or <a href="https://devblogs.microsoft.com/powershell/secretmanagement-and-secretstore-are-generally-available/" rel="nofollow noreferrer">SecretStore</a> or some other established mechanism for storing and retrieving credentials if you want a script to run unattended. E.g.:
<pre><code>$credential = Get-Credential -UserName $Env:USERNAME
# or
$credential = Import-Clixml -Path 'C:\MyCredential.cred'

Start-Process -FilePath pwsh.exe -ArgumentList '-noprofile' -Credential $credential -Wait
</code></pre>

Maybe there is a way to do it with <a href="https://technet.microsoft.com/en-us/library/hh849848.aspx" rel="noreferrer">Start-Process</a> cmdlet that I cannot find? The other related Q/A's I found on StackOverflow such as <a href="https://stackoverflow.com/q/3939731/450913">this</a>, <a href="https://stackoverflow.com/q/196949/450913">this</a> and <a href="https://stackoverflow.com/q/1173630/450913">this</a> all give a solution to do this with a custom C# code. My question is specifically, is there any straightforward way to do this in PowerShell? i.e. you are in an elevated PS console and want to run a process as non-admin.

How to run a process as non-admin from an elevated PowerShell console?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋 

腾讯云代码助手

CODING DevOps

Cloud Studio

SDK中心

API中心

命令行工具

也许有一种方法可以用 cmdlet来实现，但我找不到吗？我在StackOverflow上找到的其他相关Q/A，如、和，都给出了使用自定义C#代码来实现此操作的解决方案。我的问题是，在PowerShell中有什么直接的方法可以做到这一点吗？也就是说，您处于一个提升的PS控制台中，并且希望以非admin的形式运行一个进程。

问如何从提升的PowerShell控制台以非管理员身份运行进程？
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何从提升的PowerShell控制台以非管理员身份运行进程？EN