Powershell script not launching executable as current user

1

I have a complete powershell stops the UI on the endpoint then run a SQL script, then restarts the UI. It is launching the UI as System instead of current user account. The current code to launch the UI is

Write-Host "Restarting SubwayPOSBackOffice..."
try {
    # Get current user context
    $currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
    
    # Start process as current user
    $processInfo = New-Object System.Diagnostics.ProcessStartInfo
    $processInfo.FileName = "C:\SubwayPOS\BackOffice\SubwayPOSBackOffice.exe"
    $processInfo.UseShellExecute = $true
    $processInfo.WindowStyle = [System.Diagnostics.ProcessWindowStyle]::Normal
    
    [System.Diagnostics.Process]::Start($processInfo) | Out-Null
    
    Write-Host "SubwayPOSBackOffice restarted successfully as user: $currentUser"
} 
catch {
    $errorMsg = "Failed to restart SubwayPOSBackOffice.exe: $($_.Exception.Message)"
    Write-Error $errorMsg
    
    if (Get-Command leafMessage -ErrorAction SilentlyContinue) {
        leafMessage -EventType "ProcessStartError" -Message "Failed to restart SubwayPOSBackOffice.exe" -CustomJson -CustomData @{
            executablePath = "C:\SubwayPOS\BackOffice\SubwayPOSBackOffice.exe"
            error = $_.Exception.Message
            user = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
        }
    }
    throw
}

When run through the local Powershell ISE, it works 100% of the time, another tool it works normal as well. But when running it via BigFix, with it being in the Action Script Type : Powershell, it only runs it as System, even though the powershell script is saying to run as current user.

Has anyone seen this behavior before, any suggestions of fixing it?

BigFix Lifecycle 11.0.4

2

Nothing there appears to impersonate another user
.

When you run

[System.Security.Principal.WindowsIdentity]::GetCurrent().Name

As LocalSystem, that’s going to return back Local system.

You would need to do something to find logged-on user sessions, figure out which one you want, and launch as that user.

I’m not sure how to do that in PowerShell, or whether it’s even possible without providing the user’s password.

I’d recommend running as native ActionScript if you want to use our overrides to detect and use the logged-on user.

3

To my knowledge, there is no way to impersonate the current user in Powershell without either directly entering the current user’s password or without running Powershell as the current user.

If you convert the Powershell to action script, BigFix is able to impersonate the current user in action script. Try this:

// Create script
createfile until ENDOFSCRIPT
Write-Host "Restarting SubwayPOSBackOffice..."
try {{
    # Get current user context
    $currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
    
    # Start process as current user
    $processInfo = New-Object System.Diagnostics.ProcessStartInfo
    $processInfo.FileName = "C:\SubwayPOS\BackOffice\SubwayPOSBackOffice.exe"
    $processInfo.UseShellExecute = $true
    $processInfo.WindowStyle = [System.Diagnostics.ProcessWindowStyle]::Normal
    
    [System.Diagnostics.Process]::Start($processInfo) | Out-Null
    
    Write-Host "SubwayPOSBackOffice restarted successfully as user: $currentUser"
} 
catch {{
    $errorMsg = "Failed to restart SubwayPOSBackOffice.exe: $($_.Exception.Message)"
    Write-Error $errorMsg
    
    if (Get-Command leafMessage -ErrorAction SilentlyContinue) {{
        leafMessage -EventType "ProcessStartError" -Message "Failed to restart SubwayPOSBackOffice.exe" -CustomJson -CustomData @{{
            executablePath = "C:\SubwayPOS\BackOffice\SubwayPOSBackOffice.exe"
            error = $_.Exception.Message
            user = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
        }
    }
    throw
}
ENDOFSCRIPT

// Delete script if already detected to prevent errors w/ copy action
parameter "Script" = "{(pathname of client folder of current site) & "\__Download\OfficeShortcuts.ps1"}"

if {exists file (parameter "Script")}
    delete "{(parameter "Script")}"
endif

// Copy script to path
copy __createfile "{(parameter "Script")}"

// Run script
override wait
runas = currentuser
wait powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "{parameter "Script"}"

// Cleanup
if {exists file (parameter "Script")}
    delete "{(parameter "Script")}"
endif

Action script uses braces for relevance substition {} so any time you want to use an opening brace in PowerShell, you must escape it out using two opening braces {{. Put your PowerShell in a text editor and replace all { with {{.