I’m trying to build a script that requires entering admin credentials only once, and runs commands as admin, some of them as the logged on local user. I don’t want to enter multiple credentials when the PC is already logged in. I’m a Domain Admin, running the script on a Non-Admin’s local PC. I have registry changes to make, and Quality of life changes. Some need to be run as admin, some as local user.

    # First Test
    $aCredential = Get-Credential -Message "Enter Domain Admin Credentials`t`t(domainusername)"

    # Second Test
    $username = "domain$(Read-Host)" 
    $password = Read-Host | ConvertTo-SecureString -AsPlainText -Force
    $aCredential = [PSCredential]::New($username,$password)    

I tried to run the script as the local user, then prompt for the admin credentials for specific tasks that require it. Here’s some examples

First tried this
Remove-Item "C:usersPublicdesktopZoom Workplace.lnk" -Credential $aCredential

Then This

    $job = Start-Job {Remove-Item "C:usersPublicdesktopZoom Workplace.lnk"} -Credential $aCredential
    Wait-Job $job
    Receive-Job $job

Cannot remove item C:usersPublicdesktopFirefox.lnk: Access to the path ‘C:usersPublicdesktopFirefox.lnk’ is denied.

And I’ve also attempted to run something like this

    $powershellArguments = "\serverdirectoryDeleteShortcutsFromPublicDesktop.ps1"
    Start-Process "powershell.exe" -Credential $aCredential -ArgumentList $powershellArguments

Tried this

    New-PSDrive -Name X -PSProvider FileSystem -Root "C:usersPublicdesktop" -Credential $aCredential
    Remove-Item "X:Zoom Workplace.lnk" #with or without -Credential $aCredential

Remove-Item : Cannot remove item C:usersPublicdesktopFirefox.lnk: Access to the path ‘C:usersPublicdesktopFirefox.lnk’ is
denied.
At line:1 char:1

• Remove-Item “X:Firefox.lnk”

•   + CategoryInfo          : PermissionDenied: (C:usersPublicdesktopFirefox.lnk:FileInfo) [Remove-Item], UnauthorizedAccessExce 
  ption
    + FullyQualifiedErrorId : RemoveFileSystemItemUnAuthorizedAccess,Microsoft.PowerShell.Commands.RemoveItemCommand
  
  
  

I’ve also tried working with this.

#Use System.Diagnostics to start the process as Admin
$ProcessInfo = New-Object System.Diagnostics.ProcessStartInfo

#With FileName we're basically telling powershell to run another powershell process
$ProcessInfo.FileName = "powershell.exe"

#CreateNoWindow helps avoiding a second window to appear whilst the process runs
$ProcessInfo.CreateNoWindow = $true

#Note the line below contains the Working Directory where the script will start from
$ProcessInfo.WorkingDirectory = $env:windir
$ProcessInfo.RedirectStandardError = $true 
$ProcessInfo.RedirectStandardOutput = $true 
$ProcessInfo.UseShellExecute = $false

#The next 3 lines are the credential for UserB, as you can see, we can't just pass $Credential
$ProcessInfo.Username = $aCredential.GetNetworkCredential().username
$ProcessInfo.Domain = $aCredential.GetNetworkCredential().Domain
$ProcessInfo.Password = $aCredential.Password

#The line below is basically the command you want to run and it's passed as text, as an argument
#The Outer Double Quotes are actually single quotes in my script, just not here on stack overflow
$ProcessArguments = "Remove-Item "C:usersPublicdesktopFirefox.lnk""

#Remove Public Desktop shortcuts
$ProcessInfo.Arguments = $ProcessArguments

#Finally start the process and wait for it to finish
$Process = New-Object System.Diagnostics.Process 
$Process.StartInfo = $ProcessInfo 
$Process.Start() | Out-Null 
$Process.WaitForExit() 

#Grab the output
$GetProcessResult = $Process.StandardOutput.ReadToEnd()

#Print the Job results
#I have no idea how to actually have the process RETURN a result, but that's another issue.
$GetProcessResult

I have run the following and it says the Credentials are Good

Add-Type -AssemblyName 'System.DirectoryServices.Protocols'

# Specify credential details
$domain = 'example.com'
$userName = 'Username'
$password = 'Password'

try {
    # Create a credential object
    $netCred = New-Object -TypeName System.Net.NetworkCredential -ArgumentList $aCredential.GetNetworkCredential().username, $aCredential.Password

    # Create an LdapConnection object
    $connection = New-Object -TypeName  System.DirectoryServices.Protocols.LdapConnection -Argumentlist $aCredential.GetNetworkCredential().Domain
    $connection.Credential = $netCred

    # Attempt to connect
    # Will raise an exception if credentials are wrong, DC is unavailable, etc
    $connection.Bind()

    # Do something with the valid credentials
    Write-Output -InputObject "Credentials are good!"
}
catch [System.DirectoryServices.Protocols.LdapException] {
    # Failed to connect, so give the user a friendly error message
    Write-Output -InputObject "Error connecting to the '$domain' as '$userName': $($_.Exception.Message)"
}
finally {
    # Dispose of the connection
    $connection.Dispose()
}

I may just run these as two separate scripts at this point as I’ve been trying everything I can think/search up. I’ve tried things in reverse as well. Run the script as admin, but then I don’t know how to send ANY commands as the local user without prompting for a password as that user.

Any advice or suggestions? I’m part of a security group that grants me admin access and local PC admin access.

Thank you!