task scheduler "Run task as soon as possible..."

PowerShell Help
1

Hello all,

I’m trying to create a script that remotely gives a user admin permissions to their system and also creates a scheduled task locally on their system to remove the admin permissions 6 hours later.

I 've got just about everything working except creating the task. I have been unable to identify a way to create a task with the setting “run task as soon as possible after a scheduled start is missed”. I noticed some people online bring this up and a work around seems to be referencing an xml file instead. I then created a task and exported it for an xml template.

Can someone tell me if i am going about this the correct way, and if so, i will show my error message and maybe you can point out my issue.

Go easy on me in any explanations please. I’m a powershell newbie.

Thank you!

[xml]$finalxml = @"
<xml code/template goes here...>
"@
$principal = New-ScheduledPrincipal -userid "NT Authority\system" -logontype serviceaccount -RunLevel Hightest
invoke-command -computername $pcname -scriptblock { Register-scheduledtask -xml $finalxml -taskname AdminPermissionRemoval -Principal $principal }

Error returned…
“Cannot validate argument on parmeter ‘xml’…”

2

The error message is key here. Something is not correct in your xml, so without seeing that, it’s hard to say what is wrong. More important however is the logic behind what you are doing. Why would you give someone admin privileges for 6 hours and remove them with a scheduled task? Once they have admin privileges they can just delete the task and keep it. Are you just blindly trusting the user or relying on user ignorance to enforce security? Whatever is driving this need I’m sure there is a better way even if the user needs admin privileges on the local machine for 6 hours, a better way to do it is with a GPO on the domain.

3

Have you tried this:

invoke-command -computername $pcname -scriptblock { Register-scheduledtask -xml $Using:finalxml -taskname AdminPermissionRemoval -Principal $Using:principal }
I second Mike R. thoughts and suggestion. Giving admin for 6 hours is a bad idea.