I'm an IT tech with a few years of experience, but I'm still figuring out the processes at my new company. Currently, standard users can't access our directory of application installers, which means when someone needs software like Adobe or M365, I have to log in with my admin account, install it, and then log out. I'd like to reduce the number of times I need to use my Domain Admin (DA) account interactively if possible.
So, I'm wondering: If I run PowerShell as my admin account to navigate to the shared directory and install the software that way, is that considered bad practice? Ideally, I'd like to do this without having to sign out the user during the process. I know using DA accounts this way isn't great, and I'm exploring better solutions like tools for more controlled access, but for now, I'm curious about this method. Thanks for your help!
5 Answers
Actually, what you’re doing now might be the best approach for your situation, balancing security and convenience. You're using DA access properly and logging out closes your connections, which is secure. If it works fine without complexity, it’s probably not worth the hassle to change things right now.
You don't necessarily need to log in as an admin to install software. You can run programs with elevated privileges instead. To access a shared location that a different user can see, just run PowerShell or Command Prompt as that user. Also, don’t forget about using remote management tools for similar tasks, which could save you time.
In automation scenarios, you might want to store credentials securely in a vault and only load them when needed. After using them, delete them right away to keep them safe. Just make sure whatever you do doesn’t leave sensitive info in logs or visible locations.
I often use 'RunAs' in a support scenario. You can launch PowerShell under your account right from the user's desktop. If done properly, it works without issues as long as you avoid apps that install in the user's AppData folder. It's generally fine to do this when UAC is on; just launch Admin PowerShell once and run other tasks from there without confirming every action.
I'd advise against storing credentials in PowerShell scripts. Input them interactively instead. As a safer alternative, consider using a tool like PsExec to run PowerShell as an admin without needing to sign out. You could also just download installers directly from Adobe instead of relying on a network share, which could simplify things.

Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures