Check if powerhshell was started using "run as administrator"-CodePudding

i found an old question on this topic. However, i am not clear. I have a script that checks, if PS has been run using "run as administrator" and if yes it does the job, otherweise it prompts that the script must be run as administrator.

$currentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
$CheckforAdmin = $currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

it gives true or false. I have if-else statement that does the rest.

    If($CheckforAdmin -eq 'True'){
        $MSG = ""
        If(($EventLogCheck -ne $EventLog) -or ($EventLogsourceCheck -ne 'True')){
            New-EventLog -LogName $EventLog -Source $EventLogSource -ErrorAction Stop
            $MSG = "$env:USERNAME has successfully created a new eventlog named $EventLog with the source $EventLogSource."
            Write-EventLog -logname $PiEventLog -source  $PiEventLogSource -eventID 1021 -entrytype Information -message $MSG
        }
        else{
            $MSG = "$env:USERNAME tried to create an EventLog named $EventLog with the source $EventLogSource. `nSince the EventLog and the source already exist, this step was aborted."
            Write-EventLog -logname $EventLog -source  $EventLogSource -eventID 1021 -entrytype Information -message $MSG
        }

#           Wenn der Parameter Silent auf true gesetzt ist, wird das Skript nach der Erstellung des EventLogs unmittelbar beendet.
        if($install -eq $true){
            Write-Host $MSG
            Read-Host 'Press any key to continue...'
        }
        exit
    }
    else{
        Write-Host "The Script must be executed as admin"
     [System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms')
        [System.Windows.Forms.MessageBox]::Show('Installation: The script must be run as administrator in order to create the event log', 'Run as admin')
        exit
    }

It works well, if i am logged in with a normal user. But on my server where i want to run the script, i log in as domain administrator. Even if if run the script just double clicking on it, it runs instead of prompting that the script must be run using "run as administrator".

I red the articles about UAC (User Account control) and as far as i understood: running a script using "run as administor" is actually the same as logging in as domain administrator and double clicking on the script.

Is there any other way to check, if the script was run using "run as administrator" option that shows up if u right click on powershell (doesn't matter, whether you are logged in as admin or not) ?

CodePudding user response：

At the top of your script add the line:

 #Requires -RunAsAdministrator

then remove all your code to check for an administrator.

If the user running the script is not an elevated administrator, a message will be displayed and the execution of the scripts stops.

CodePudding user response：

Original comment:

How did you implement the prompt? Because obviously, this part only returns $true or $false. I suppose a way to work around this would be something like

PowerShell -NoProfile -ExecutionPolicy Unrestricted -Command "& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Unrestricted -File ""PS_Script_Path&Name.ps1""' -Verb RunAs}"

To call the script as admin again, if it wasnt before.

Newly added:

Additionally, you have an error in your if-statement. To compare to boolean, you want to have your if-statement like following:

 If($CheckforAdmin -eq $true){

Comparing against strings can lead to problems. Otherwise I cannot locate any other errors.