Search code examples
windowsuser-interfacecmdadministration

Can I ask Windows what permissions I need to perform an action?


Is there a way to say "I'm about to issue some commands, and if they can't run figure out why, and fix it." Ideally it would give me a simple Y/N option to fix it (either one time or forever). Or some override like how run as administrator is supposed to work that just skips all permissions checking? Or a way to turn permissions checking off?

Something like this:

C:> delete printer GHI

You can't delete printer WXY because 1) you don't have permission XYZ, and 2) you aren't a member of group WXY, 3) there are 4394568 unprinted jobs in the queue for the GHI printer, and 4) you don't have ABC to do DEF and 5) your JKL is set to MNO.

Would you like Windows to grant you permission to XYZ, add you to membership of group WXY, and give you ABC to do DEF, set your JKL to PQR and delete the 4,394,568 unprinted jobs, and remove the printer GHI? [O/Y/N] ([O]ne time only, [Y]es permanently, [N]o)? Y

Provide an administrator username and password for domain GHI.

Username: GHI/Administrator

Password: password

Printer GHI has been deleted. Have a nice day.

C:>


Solution

  • To get history and command line editing features like in Bash, check out the PSReadline module. PowerShell already has pretty good tab-completion but PSReadline makes it better.

    BTW PowerShell isn't so much about working with APIs as it is about working with objects. Managing printers is pretty straight forward:

    8> Get-Printer
    
    Name                           ComputerName    Type         DriverName                PortName        Shared   Publishe
                                                                                                                   d
    ----                           ------------    ----         ----------                --------        ------   --------
    Send To OneNote 2013                           Local        Send to Microsoft OneN... NUL:            False    False
    Quicken PDF Printer                            Local        Amyuni Document Conver... NUL:            False    False
    Microsoft XPS Document Writer                  Local        Microsoft XPS Document... PORTPROMPT:     False    False
    HP Photosmart 7520                             Local        HP Photosmart 7520 ser... 192.168.1.127_1 False    False
    hp LaserJet 1300 PCL 5                         Local        hp LaserJet 1300 PCL 5    DOT4_001        True     False
    Fax                                            Local        Microsoft Shared Fax D... SHRFAX:         False    False
    
    9> Remove-Printer 'Microsoft XPS Document Writer'
    Remove-Printer : Access was denied to the specified resource.
    At line:1 char:1
    + Remove-Printer 'Microsoft XPS Document Writer'
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : PermissionDenied: (MSFT_Printer (N...= "", Type = 0):ROOT/StandardCimv2/MSFT_Printer) [R
       emove-Printer], CimException
        + FullyQualifiedErrorId : HRESULT 0x80070005,Remove-Printer
    

    Fair point on having more helpful error messages. This is something the product has been getting better at e.g.:

    10> Invoke-Command -ComputerName . {Get-Service spooler}
    [localhost] Connecting to remote server localhost failed with the following error message : The client cannot connect
    to the destination specified in the request. Verify that the service on the destination is running and is accepting
    requests. Consult the logs and documentation for the WS-Management service running on the destination, most commonly
    IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to analyze and
    configure the WinRM service: "winrm quickconfig". For more information, see the about_Remote_Troubleshooting Help
    topic.
        + CategoryInfo          : OpenError: (localhost:String) [], PSRemotingTransportException
        + FullyQualifiedErrorId : CannotConnect,PSSessionStateBroken