Windows – Use Powershell to start a GUI program on a remote machine

powershellremotewindowswindows 7

There are two Windows 7 machines setup on the same network.
I enabled everything needed so that they could communicate with winrm.

When I run the following command:

Invoke-Command -ComputerName REMOTE-PC -ScriptBlock { Start-Process calc.exe }

It works correctly, but the program is never seen on the remote machine. As far as I can tell, this is expected behavior.

I assume the process starts correctly, and then is immediately closed as the session ends. How do I run the program so that it appears on the host machine?

Best Answer

By design, you are not really supposed to be able to launch processes in other people's sessions.

(To clarify, even if you are logged on interactively at a computer desktop, and also have another separate network logon to the same machine at the same time using the same credentials, those still count as two different logon sessions.)

This is simply against the security model of Windows itself and attempts to subvert it will be frowned upon. So you'll not likely find an easy, supportable way of doing this. It is technically possible, but it involves running as Local System, copying another logged on user's security token, and launching a process with that alternate token. You would need the Windows API for this, which is pretty much the only thing Powershell isn't very good at. See WTSQueryUserToken and CreateProcessAsUser in the Windows API for more detail on that.

One other idea, so as not to totally pee in your Cheerios, you might be able to accomplish this by remotely creating a scheduled task that launches the process. See https://devblogs.microsoft.com/scripting/how-can-i-remotely-start-an-interactive-process/ for more info on that.

Edit: Oh, and I forgot... pretty sure PsExec with the -i parameter can do that. You have to supply the logon session ID. And have permissions to do it. It most likely uses the same Windows API that I mentioned, which leverages the fact that PsExec installs a temporary service that runs as Local System.

Related Topic