CODEWITHSUNDEEP
powershell
RJ45
RJ45

Reputation: 55

How to Check User's Rights via powershell on a remote or local machine

I have a script that needs to check the user' rights on the remote machine in order to confirm the user has the permissions to copy their files. When this part of the script runs, it fails 90% of the time unless the user is already an admin on the remote machine.

This is my code:

write-host Checking User Rights
    #if the user provides and IP address, find the hostname
    if ($sourceComputerName -match $ipPattern) {
        Get-Hostname
    }
    else {
        $global:fullHostName = $env:COMPUTERNAME
    }
    Write-host $sourceFolder
    $permissionQuery = (Get-Acl $sourcefolder.substring(1, $sourceFolder.length - 2)).Access | Where-Object { $_.IdentityReference -match $adminusername } | Select-Object IdentityReference, FileSystemRights
    if (!$permissionQuery) {
        Invoke-Command -FilePath "$PSScriptRoot\LocalAdmin.ps1" -ComputerName $fullHostName -ArgumentList "$sourceRemotePath"
    }
    else {
        write-host "Admin Rights Already Exist for $adminusername at $sourceRemotePath"
    }
    clear-host

Here is the Get-Hostname Function:

function global:Get-Hostname {
    $queryHostname = [System.Net.DNS]::GetHostEntry($sourceComputerName) | Select-Object HostName | format-table -HideTableHeaders
    $stringHostName = Out-String -InputObject $queryHostname
    $splitHostName = $stringHostName.split(".", 2)
    $global:fullHostName = $splitHostName[0] -replace '\s', ''
    [void]$fullHostName
}

Here is the error:

[DESKTOPXXXX] Connecting to remote server DESKTOPXXXX failed with the following error message : Access is denied. For
more information, see the about_Remote_Troubleshooting Help topic.
    + CategoryInfo          : OpenError: (DESKTOPXXXX:String) [], PSRemotingTransportException
    + FullyQualifiedErrorId : AccessDenied,PSSessionStateBroken

Note: I am one of the network admins and I have full admin rights on the machine I ran this script on

Upvotes: 1

Views: 3267

Answers (1)

Cpt.Whale
Cpt.Whale

Reputation: 5321

For effective permissions, try out Get-NTFSEffectiveAccess from the NTFSSecurity module.

The way you're currently checking permissions doesn't check for any groups that $adminusername is a member of, and may not give you accurate information.

The most common reason for "Access is denied" is that your current user is not an administrator on the remote machine, though there are other reasons listed in the Troubleshooting Guide:

  • Powershell remoting is not (or only partially) enabled on the remote machine.
  • WinRM service is not running
  • Remote firewall profile is in "Public network" mode (only accepts powershell remoting from the same subnet)
  • The current running credentials are invalid for some reason e.g. password expired.
  • You are double-hopping (remote from PC1 to PC2, then remote again to PC3)

First, try manually providing credentials:

$cred = Get-Credential -UserName Domain\AdminUser -Message Remote
Invoke-Command -Computername $sourceComputerName -Credential $cred -ScriptBlock {Hostname}

If you still get errors, try re-running the remote powershell setup on the remote machine (and restart it):

Enable-PSRemoting -Force

Upvotes: 1

Related Questions