I have a PowerShell script that runs with elevated administrator privileges. At the end, it needs to start a second script in the currently logged-on user's normal, non-elevated context. I've tried starting a new process and invoking PowerShell, but the child process keeps inheriting the administrator token. What's the best way to launch the second script without elevation?
4 Answers
It’s usually easier to reverse the flow: start the main script in the normal user context, have it launch the administrative portion with elevation, wait for that to finish, and then continue with the non-elevated steps. That way the final process doesn’t inherit an administrator token.
For a script that must begin elevated, you can launch a new process using the logged-on user’s Explorer process as its parent. Explorer normally runs unelevated, so the child process receives the user’s standard token instead of inheriting the administrator token. A PowerShell process-management module such as ProcessEx can use Explorer’s startup information for this purpose. Find the Explorer instance with the same session ID as the logged-on user, then use it as the parent when starting the second PowerShell script.
A scheduled task can handle this, especially if you configure it to run under the target user account without elevated privileges. It requires a little setup, but it’s a reliable option for scripts that run during user-management workflows.
Another option is to use a user-context trigger. Have the administrative script signal an event, and have a process already running in the user session listen for that event and launch the non-elevated script. This avoids trying to downgrade an already elevated process directly.
The first script is triggered automatically when a user is terminated. I’ll test this approach and see whether it fits that workflow.