jenkins - Elevate creditals with powershell via Local System Account -
i want deploy code using powershell via jenkins job. works fine in powershell ise.
$username = "mydomain\builder" $password = "notmypassword" $credentials = new-object system.management.automation.pscredential -argumentlist @($username,(convertto-securestring -string $password -asplaintext -force)) $arguments = "-executionpolicy bypass -file c:\test.ps1 -nonewwindow -workingdirectory c:\windows\system32\windowspowershell\v1.0 -nologo -noninteractive" start-process "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -credential $credentials -argumentlist $arguments
but when run jenkins use local system following error message.
start-process : command cannot run due error: access denied. @ c:\windows\temp\hudson5557889306949142167.ps1:7 char:1 + start-process powershell.exe -credential $credentials -argumentlist $
if change change jenkins service account works. why won't elevated permission work under local system account?
note: code in test.ps1 new-item c:\scripts\new_file.txt
there seems restriction on commands when script run under localsystem. makes sense in terms of security, given localsystem:
has complete unrestricted access local resources. disadvantage of localsystem because localsystem service can things bring down entire system.
reference: msdn, localsystem account
there similar question @ superuser: can not create process elevated permissions localsystem account no answer far reference answer now.
there similar question @ technet: runing powershell script permissions of localsystem user answers suggesting run script via task scheduler.
i can think of using runas
/savecred
, /user:...
appropriate permissions password never expires. afair have invoke runas
/savecred
interactively once, enter credentials , take saved credentials next invocation onwards.
Comments
Post a Comment