powershell, which credentials should i use
I am new to power shell so this may be a simple question. I have configured winRM in my domain and this is working.
My workstation is Win 7 Pro SP1 running PSversion 4.0. I'm logged in as myself, a domain user who is a member of the administrators group (but not a Domain Admin). My question is, what credentials should I run the ps console in?
If I just click on windows power shell, not much works [ eg. Get-Service -name B* -ComputerName is-tr-01 ] fails with a privilege error
If I right click and Run As Administrator the above still does not work.
If I shift click and Run as Another User, use a domain admin account, the above does work, however seems to create a problem, such as if I want to pipe to csv, [eg. Get-Service -Name b* -ComputerName is-tr-01 | Export-Csv c:\services.csv ] fails with access to c: path is denied.
If I Run As Administrator [ Get-Service -Name b* | Export-Csv c:\services.csv ] removing the remote computer, this does work.
My workstation is Win 7 Pro SP1 running PSversion 4.0. I'm logged in as myself, a domain user who is a member of the administrators group (but not a Domain Admin). My question is, what credentials should I run the ps console in?
If I just click on windows power shell, not much works [ eg. Get-Service -name B* -ComputerName is-tr-01 ] fails with a privilege error
If I right click and Run As Administrator the above still does not work.
If I shift click and Run as Another User, use a domain admin account, the above does work, however seems to create a problem, such as if I want to pipe to csv, [eg. Get-Service -Name b* -ComputerName is-tr-01 | Export-Csv c:\services.csv ] fails with access to c: path is denied.
If I Run As Administrator [ Get-Service -Name b* | Export-Csv c:\services.csv ] removing the remote computer, this does work.
Do more with
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
when doing Run As Administrator, error below:
PS C:\Windows\system32> Get-Service -Name BITS -ComputerName fs1
Get-Service : Cannot find any service with service name 'BITS'.
At line:1 char:1
+ Get-Service -Name BITS -ComputerName fs1
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (BITS:String) [Get-Service], ServiceCommandException
+ FullyQualifiedErrorId : NoServiceFoundForGivenName
PS C:\Windows\system32> Get-Service -Name BITS -ComputerName fs1
Get-Service : Cannot find any service with service name 'BITS'.
At line:1 char:1
+ Get-Service -Name BITS -ComputerName fs1
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (BITS:String) [Get-Service], ServiceCommandException
+ FullyQualifiedErrorId : NoServiceFoundForGivenName
when running as Another User (who is domain admin), no error:
PS C:\windows\system32> Get-Service -Name BITS -ComputerName fs1
Status Name DisplayName
------ ---- -----------
Stopped BITS Background Intelligent Transfer Ser...
but if i want to pipe to file, I get the error below:
PS C:\windows\system32> Get-Service -Name BITS -ComputerName fs1 | Export-Csv -Path c:\services.csv
Export-Csv : Access to the path 'C:\services.csv' is denied.
At line:1 char:44
+ Get-Service -Name BITS -ComputerName fs1 | Export-Csv -Path c:\services.csv
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OpenError: (:) [Export-Csv], UnauthorizedAccessExceptio
+ FullyQualifiedErrorId : FileOpenFailure,Microsoft.
PS C:\windows\system32> Get-Service -Name BITS -ComputerName fs1
Status Name DisplayName
------ ---- -----------
Stopped BITS Background Intelligent Transfer Ser...
but if i want to pipe to file, I get the error below:
PS C:\windows\system32> Get-Service -Name BITS -ComputerName fs1 | Export-Csv -Path c:\services.csv
Export-Csv : Access to the path 'C:\services.csv' is denied.
At line:1 char:44
+ Get-Service -Name BITS -ComputerName fs1 | Export-Csv -Path c:\services.csv
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OpenError: (:) [Export-Csv], UnauthorizedAccessExceptio
+ FullyQualifiedErrorId : FileOpenFailure,Microsoft.
Your question title mentions WinRM, but you're not using PowerShell Remoting in any of the commands (i.e. Invoke-Command). The remoting used by Get-Service when using the -computername parameter is based on DCOM. To perform remote queries via WMI/DCOM, by default you need to be an administrator on the remote machine. It is also possible to adjust permissions so that non-admins can do the query.
As to the question of which credentials you should use, really the only answer I can give is to use what is required of the task you're performing. Adjust permissions on the targets if you need to use non-privileged accounts. I would expect pretty much everything to work if you opened a console using Run as Administrator and entered domain admin credentials at the UAC prompt.
As to the question of which credentials you should use, really the only answer I can give is to use what is required of the task you're performing. Adjust permissions on the targets if you need to use non-privileged accounts. I would expect pretty much everything to work if you opened a console using Run as Administrator and entered domain admin credentials at the UAC prompt.
Premium Content
You need an Expert Office subscription to comment.Start Free Trial