# Limited permissions, elevated function

**URL:** <https://forums.powershell.org/t/limited-permissions-elevated-function/9983>\
**Category:** PowerShell Help\
**Created:** [January 16, 2018, 5:45am UTC](https://forums.powershell.org/t/limited-permissions-elevated-function/9983 "2018-01-16T05:45:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![incognitotom](https://avatars.discourse-cdn.com/v4/letter/i/e495f1/32.png) [@incognitotom](https://forums.powershell.org/u/incognitotom)\
**Post date:** [January 16, 2018, 5:45am UTC](https://forums.powershell.org/t/limited-permissions-elevated-function/9983/1 "2018-01-16T05:45:43Z")

</div>

Hi,  
Im pretty sure there is a way i can do this, but not sure the approach.

I need to have a function/script that will make a change to a system that requires admin level access, but the person executing the function only has basic permissions. So i need a way to run the function or script under the elevated permissions but without having to supply the password?

I know i can pull the password in from a file, but i doubt i will be allowed to do this. I can type the password in once to setup the secure object, but then the session would need to remain open etc.

Any help would be great.

Thanks

TommyQ

---

<div class="post-metadata">

**Author:** ![sam-boutros](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/sam-boutros/32/5_2.png) [@sam-boutros](https://forums.powershell.org/u/sam-boutros)\
**Post date:** [January 16, 2018, 6:15am UTC](https://forums.powershell.org/t/limited-permissions-elevated-function/9983/2 "2018-01-16T06:15:02Z")

</div>

You pass the script/cmdlet a PSCredential object that has permissions on the remote system. You store the encrypted pwd of the PSCredential object for future use using something like Get-SBCredential of the SB-Tools module. Example:

```
#Requires -Version 5
#Requires -RunAsAdministrator

Install-Module SB-Tools,POSH-SSH -Force
Import-Module SB-Tools -DisableNameChecking

$RemoteUserName = 'domain\username'
$Cred = Get-SBCredential $RemoteUserName

Invoke-Command -ComputerName myRemoteComputer -Credential $Cred -ScriptBlock {
    myCommandList
}
```

You will be asked for the pwd of the $RemoteUserName the first time you run this for a given user.  
If you mistype the pwd or want to change it, use the -Refresh parameter with the Get-SBCredential cmdlet.  
Encrypted pwd is tied to the user, meaning that copying the encrypted pwd file will not work if run under another user context.

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:36pm UTC](https://forums.powershell.org/t/limited-permissions-elevated-function/9983/3 "2024-05-16T20:36:51Z")

</div>