win32_process create fails with Unknown failure for service account user

Question

I have a windows service account user, using which i'm trying to create a background process using the WMI win32_proces. But fails with Unknown Failure. (Tried this with administrator, nonadmin, domain admin, domain nonadmin users. works fine)

 $process = [WMICLASS]"\\$computername\ROOT\CIMV2:win32_process"
 $processinfo = $process.Create("powershell.exe -WindowStyle Hidden test.ps1")
 Write-Host $processinfo.returncode

Answer 1

As explained in this msdn blog post: Win32_Process.Create fails if user profile is not loaded, the WMI call is hardcoded to access the users profile through the registry.

If the user profile is not already loaded in HKU, WMI tries to load it into the registry using RegLoadKey.

This fails unless the user account in question have the following privileges on the local machine:

• SeRestorePrivilege
• SeBackupPrivilege

So, either

1. Grant these privileges to the account in question
2. Call LoadUserProfile for the user in question prior to calling Win32_Process.Create
3. Or use Start-Process instead of WMI!

---

# Set up service account credentials
$Username = "domain\svcaccount"
$Password = "7oPs3çürEûN1c0deZ"
$Credential = New-Object pscredential -ArgumentList $Username,$(ConvertTo-SecureString $Password -AsPlainText -Force)

# Establish a session on the remote machine
$RemoteSession = New-PSSession -ComputerName $computername -Credential $Credential

# Launch the process with Start-Process -LoadUserProfile
Invoke-Command -Session $RemoteSession {
    Start-Process 'powershell.exe' -LoadUserProfile:$true -Argumentlist 'test.ps1' -WindowStyle Hidden 
}

# Cleanup
Remove-PSSession -Session $RemoteSession
Remove-Variable -Name Username,Password,Credential