Why can't I use PowerShell's Start-Process with both -Credential and -Verb parameters?

user_1020139 0
Viewed 1277

Using powershell.exe, I want to emulate cmd.exe's runas command with the additional benefit of escalating privileges through UAC.

However, if I both supply both -Credential and -Verb Runas parameters to Start-Process, I get the error below:

Start-Process powershell.exe -Credential (New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList 'username',(ConvertTo-SecureString 'password' -AsPlainText -Force)) -ArgumentList '-NoProfile' -Verb RunAs

Start-Process : Parameter set cannot be resolved using the specified named parameters.
At line:1 char:1
+ Start-Process powershell.exe -Credential (New-Object -TypeName System ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (:) [Start-Process], ParameterBindingException
    + FullyQualifiedErrorId : AmbiguousParameterSet,Microsoft.PowerShell.Commands.StartProcessCommand

Using only one of these parameters yields no errors:

Start-Process -Verb RunAs powershell.exe -ArgumentList "-NoProfile"

Why is that? Both syntax forms of Start-Process accept [<CommonParameters>], which -Verb Runas belongs to?

powershell
1 Answers

The -Verb parameter is only available in one of the parameter sets (if you do Get-Help Start-Process you can see it explictly listed in the second set):

SYNTAX
    Start-Process [-FilePath] <String> [[-ArgumentList] <String[]>] [-Credential <PSCredential>] [-LoadUserProfile] [-NoNewWindow] [-PassThru] [-RedirectStandardError <String>] [-RedirectStandardInput <String>] [-RedirectStandardOutput <String>] [-UseNewEnvironment] [-Wait] [-WindowStyle {Normal | Hidden | Minimized | Maximized}] [-WorkingDirectory <String>]
    [<CommonParameters>]

    Start-Process [-FilePath] <String> [[-ArgumentList] <String[]>] [-PassThru] [-Verb <String>] [-Wait] [-WindowStyle {Normal | Hidden | Minimized | Maximized}] [-WorkingDirectory <String>] [<CommonParameters>]

It's not a part of CommonParameters, that just includes things like -Debug, -Verbose, -ErrorAction etc. (see the full list here).

This seems to be a possible workaround:

Start-Process powershell -Credential mydomain\myuser -ArgumentList '-noprofile -command &{Start-Process powershell -verb runas}'
user_27960580
Related