Wired error of get-credential for non-privilege user



Not sure if it is right place, but I discovered this while using monad.

System: Windows XP Home, .NET Framework SDK 2.0, Monad beta3

If login as a member of Administrators group, MSH.exe runs perfectly.
I am writing "su.msh" script (go to http://mshforfun.blogspot.com/
for detail)

There is a non-privilege user "testac" who belong to Users and
Everyone group. When login as "testac", msh.exe launched OK. If
you login as a member of Administrators group and try to launch msh.exe
(within a msh window of course) using RUNAS.exe (runas /profile
/User:testac msh.exe), msh.exe launched OK.

Problem really come out when you using get-credential cmdlet and pass
Username and Password to Process.Start() method.

$SuAccount = get-credential
$StartInfo = new-object System.Diagnostics.ProcessStartInfo
$StartInfo.FileName = "msh.exe"
$StartInfo.Arguments = "-nologo -noprofile"
$StartInfo.UserName = $SuAccount.UserName
$StartInfo.Password = $SuAccount.Password
$StartInfo.LoadUserProfile = $true
$StartInfo.UseShellExecute = $false
$StartInfo.WorkingDirectory = (get-location).Path
[System.Diagnostics.Process]::Start($StartInfo)

First time you run script:
Cmdlet get-credential at command pipeline position 1
Supply values for the following parameters:
Credential
Exception calling "Start" with "1" argument(s): "Logon failure: unknown
user name or bad password"
At D:\msh\su.msh:11 char:36
+ [System.Diagnostics.Process]::Start( <<<< $StartInfo)

Second time you run script:
No error, works like runas

Third time you run script:
Cmdlet get-credential at command pipeline position 1
Supply values for the following parameters:
Credential
Exception calling "Start" with "1" argument(s): "Logon failure: unknown
user name or bad password"
At D:\msh\su.msh:11 char:36
+ [System.Diagnostics.Process]::Start( <<<< $StartInfo)

Fourth time you run script:
No error, works like runas

Fifth time you run script:
Cmdlet get-credential at command pipeline position 1
Supply values for the following parameters:
Credential
Exception calling "Start" with "1" argument(s): "Logon failure: unknown
user name or bad password"
At D:\msh\su.msh:11 char:36
+ [System.Diagnostics.Process]::Start( <<<< $StartInfo)

So you see patterns here? I don't have detailed trace information,
but I am pretty sure there is something wrong with get-credential
cmdlet (or maybe it is Process.Start() method). Or it is simply a bug?


Tony
http://mshforfun.blogspot.com/

.



Relevant Pages

  • Re: How to make a AD group member of the local administrators grou
    ... Can I use your script and replace the user ingo with the group info or do I ... Clemens de Brouwer ... that group to the local Administrators group. ... ' Check if user already a member. ...
    (microsoft.public.windows.server.scripting)
  • Re: Authenticate Computer and Users to particular User Group
    ... Objective: Login authentication must be verified using this scenario: ... If computer is member of "AA or BB computer" group ... appreciate it if someone could help me out with a starter script. ... PowerShell has some drawbacks for logon scripts: ...
    (microsoft.public.scripting.wsh)
  • Re: Use the "Managed By" field in AD to set as local Admin
    ... I think the way must be in the logon script. ... Administrators group, you can run it repeatedly until there is no message ... "Domain Admins" should be a member of the local Administrators group on ... Dim strComputerDN, strComputer, strManagerDN ...
    (microsoft.public.windows.server.active_directory)
  • Re: Use the "Managed By" field in AD to set as local Admin
    ... I think the way must be in the logon script. ... Administrators group, you can run it repeatedly until there is no message ... "Domain Admins" should be a member of the local Administrators group on ... Dim strComputerDN, strComputer, strManagerDN ...
    (microsoft.public.windows.server.active_directory)
  • Re: I need to change the group membership using a logon script
    ... admins group in order to run the script. ... I believe users need to be members of the local Administrators group to run ... "Domain Admins" is made a member of the local Administrators group on the ... Administrators groups on the computers. ...
    (microsoft.public.scripting.vbscript)