Logon scripts are running with admin powershell by default can this be changed?

Question

Trying to configure a logon script (via Group Policy) on a Windows AMI (running on AWS). One of the things the script does is prompt the user for credentials at logon (via $host.ui.PromptForCredential) and use New-PSDrive to mount a network drive with said credentials.

This all works fine...with one exception, it runs the script using elevated "Administrator" PowerShell. The result is that the drive mounts but is only accessible via Admin powershell or Admin command prompt, not regular command prompt or Windows Explorer.

I've tried using a batch script to start the PowerShell script but that batch script ends up running in Admin command prompt and launching the PowerShell script in admin PowerShell as well. I've set the execution policy for the instance to RemoteSigned (the script is stored locally as part of the image).

I don't understand this, all the documentation seems to indicate that scripts run via the Local Group Policy > User Configuration > Windows Settings > Scripts(Logon/Logoff) run as the user, it even says that in the Description of "Scripts (Logon/Logoff)"! Is there some setting somewhere that's causing the script to run with elevated permissions?

OS info: OS Name Microsoft Windows Server 2019 Datacenter Version 10.0.17763 Build 17763

BlueJ2598 · Accepted Answer · 2023-11-02 23:35:59Z

2

Five hours of searching and somehow this didn't come up until I specifically looked in serverfault.com:

https://serverfault.com/questions/586683/gpo-run-powershell-logon-script-after-explorer-exe-has-been-loaded

The answer? To run scripts at logon as non-admin instead of elevated:

Set execution policy to remote signed.
Run the script from "User Configuration => Policies => Administrative Templates => System => Logon => Run these programs at user logon" NOT "User Configuration > Windows Settings > Scripts(Logon/Logoff)"

:|

answered Nov 2, 2023 at 23:35

BlueJ2598

311 silver badge3 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

mklement0 Over a year ago

Nice find, though it seems that "Policies" shouldn't be in the path (at least I don't have such a node under "User Configuration" on my non-domain Windows 11 machine when I run gpedit.msc).

Collectives™ on Stack Overflow

Logon scripts are running with admin powershell by default can this be changed?

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related