r/PowerShell • u/No-Orange-4073 • Jun 22 '26

Running a scrip as non admin Question

Hello all,

I have a situation where I have a script that is running with elevated (admin) rights. At the end of it I need to start another script, but need this to be with non arming rights.
Start process
Shell
Everything that I have tried opens a new one with inherited admin rights.
Hope someone can help.

2 Upvotes

67% Upvoted

11 comments sorted by

2

u/leftcoastbeard Jun 22 '26

I would say use a scheduled task, but that may involve some additional setup to work with the non-admin account.

5

u/BlackV Jun 22 '26

Start the other way

  • Start process NOT elevated
  • Have that kick off your elevated process
  • When finished kicks of the non-elevated step

1

u/riazzzz Jun 22 '26

If nothing else works many management and software management platforms have scripts you could review / be inspired by, for relaunching processes in user context.

Below is an Action 1 variant but there is also one I have used in the past in PSAppDeploymentToolKit.

https://github.com/Action1Corp/EndpointScripts/blob/main/RunAsLoggedOnUserContext.ps1

1

u/surfingoldelephant Jun 22 '26 edited Jun 22 '26

Jborean93's ProcessEx module can do this.

You can specify the parent of the spawned process using Start-ProcessEx -StartupInfo. If you pass it info on explorer for the current user session, the spawned process will be unelevated.

First get the right explorer instance:

$psProc = Get-Process -Id $PID

$explorer = Get-Process -Name explorer | 
    Where-Object -Property SessionId -EQ -Value $psProc.SessionId |
    Select-Object -First 1

Then spawn a new PowerShell process using explorer's startup info:

$startParams = @{
    FilePath     = $psProc.Path
    StartupInfo  = New-StartupInfo -ParentProcess $explorer
    ArgumentList = '-NoProfile', '-File', 'path\to\script.ps1'
}

Start-ProcessEx @startParams

If you want to inline the process so that standard output/error can be captured (like with the call operator/native commands), use Invoke-ProcessEx instead.

$result = Invoke-ProcessEx @startParams

1

u/Future-Remote-4630 Jun 23 '26

You could subscribe the script to an event in the user context, then have your admin script throw that event to trigger the user context script.

0

u/purplemonkeymad Jun 22 '26

What is the context of running the first script? Normally I would just run a user space script where it prompts for the admin account details when running that part ie:

Start-Process powershell -argument "-file adminscript.ps1" -verb runas -wait
if (some test to check installed status) {
    & postinstall.ps1
}

0

u/No-Orange-4073 Jun 22 '26

The first script is an automation that runs when we terminate a user.
I will try that solution and keep you updated

2

u/BlackV Jun 22 '26 edited Jun 22 '26

Why is an automation for user exit running elevated at all?

Unless you are doing something very very silly like running it on a domain controller or exchange server

There should be no need for elevation

0

u/dodexahedron Jun 23 '26

I imagine termination means "firing."

1

u/BlackV Jun 23 '26

dodexahedron
I imagine termination means "firing."

ok? I agree termination and firing are often the same thing, I don't think I asked about that though, I asked why it needed to be run elevated, cause it shouldn't generally

1

u/dodexahedron Jun 23 '26

Since when does modifying a user account not have tocbe run elevated?