Powershell 5.0 Invoke-Command Start Service with Credential

Question

We have a problem with a Service on a Server. So we decided to write a PS-Script that a "normal" User without Admin privileges can start this Service. I have practiced now 2 Day's on this little Script. I'm a newbie (Apprentice) in PS but im glad that it works when I run it as an Admin. But why the heck not as an User?

I have generated the "Secure" Password as follow:

"P@ssword1" | ConvertTo-SecureString -AsPlainText -Force | ConvertFrom-SecureString | Out-File "C:\Temp\Password.txt"

I took the SecureString and pasted it in my Script that looks like this:

 $User = "DOMAIN\USER"
    $PwHash = "01000000d08c9ddf0....."
    $MyCredential=New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $User, ($PWHash | ConvertTo-SecureString) 
    Invoke-Command -ComputerName "MyServer" -ScriptBlock {Get-Service -Name "MyService" | Set-Service -Status Running} -Credential ($MyCredential)

The failure pops up by the $MyCredential row: ConvertTo-SecureString: Key in specific Status is not valid.

I have nowhere read that for an ConvertTo... cmd are Admin rights needed. Enable-PSRemoting is active on the specific Server.

Thanks for your time and engagement

Dirty.Stone

Answer 1

IMHO, you're going about this all wrong. This is an example of the kind of task you would use JEA (Just Enough Admin) for. Create a constrained, delegated session on the target server, configured with a function for starting or restarting that service and running under a local account that has permission to control the service, and then grant the non-admin users permission to use that session.