Run a PowerShell script from a cmd batch as admin

Question

I have a PowerShell setup which I want to execute on a computer where perhaps the execution policy is restricted and requires admin rights.
Ideally, I could wrap it in a cmd batch like follows:

powershell -Command "Start-Process powershell -Verb runAs -ArgumentList '-noexit','-ExecutionPolicy','bypass','-File','C:\path\setup.ps1'"

The problem is that I can't make it to work when C:\path\setup.ps1 contains spaces, and also the path does not work if relative (with cd C:\path).
Any help?

@AbrahamZinala: No. The whole purpose of the cmd batch is to ask the user to elevate and to temporarily allow script execution. Hence, the arguments `-Verb runAs` and `ExecutionPolicy bypass`. — antonio, Jan 17 '22 at 00:51
I'm aware of the arguments, was just trying to provide an alternate solution while getting more context. — Abraham Zinala, Jan 17 '22 at 00:57
Why is Cmd needed to run the script? Why not use a self-elevating full PowerShell script? — Santiago Squarzon, Jan 17 '22 at 02:40
@SantiagoSquarzon if the execution policy is restricted you cannot execute a self elevating script in the first place. — another victim of the mouse, Jan 17 '22 at 02:54

mklement0 · Accepted Answer · 2023-03-22T15:31:28.240

In Windows PowerShell (see bottom section for PowerShell (Core) 7+), using Start-Process -Verb RunAs to launch a command with elevation (as admin), invariably uses C:\Windows\SYSTEM32 as the working directory - even a -WorkingDirectory argument, if present, is quietly ignored.
Thus, in order to set a custom working directory and to invoke a script there, the -Command CLI parameter must be used, and a Set-Location (cd) call must precede a call to a script specified by relative path.
While passing the pass-through arguments individually to the Start-Process cmdlet's -ArgumentList parameter may be conceptually preferable, a long-standing bug unfortunately makes it better to encode all arguments in a single string - see this answer.
Doing all this from cmd.exe, via powershell.exe, the Windows PowerShell CLI, complicates matters due to escaping requirements.

Applied to your powershell.exe CLI call,
assuming working dir. C:\path 1 and script file setup 1.ps1:

powershell -Command "Start-Process -Verb RunAs powershell '-NoExit -ExecutionPolicy Bypass -Command cd \\\"C:\path 1\\\"; & \\\".\setup 1.ps1\\\"' "

Note how the embedded " chars. are doubly escaped, as \\\": first as \" in order to be preserved during the outer powershell.exe call, and then again for the inner one.
While this typically works, there are edge cases where \-based escaping is not enough, namely if the script path or file name contains a cmd.exe metacharacter, such as &; in that case, "^"" (sic) must be used for the first round of "-escaping:

powershell -Command "Start-Process -Verb RunAs powershell '-NoExit -ExecutionPolicy Bypass -Command "^"" cd \\"^""C:\path 1\\"^""; & \\"^"".\setup 1.ps1\\"^"" "^""'"

Note:

From cmd.exe (batch files), "^"" (sic) is the most robust way to pass " that are embedded in an overall "..." string to powershell.exe, as shown above, whereas it is "" for pwsh.exe, the PowerShell (Core) CLI (see below).
By contrast, from a shell-free context (e.g., a scheduled task) \" works robustly, in both editions.
See this answer for details.

When you call pwsh.exe instead - the PowerShell (Core) 7+ CLI - simplifications are possible and a workaround may not even be needed:

pwsh.exe does preserve the caller's working directory by default even with -Verb RunAs and does respect a -WorkingDirectory argument with -Verb RunAs.
In addition to \", pwsh.exe more simply supports "" for embedding " chars. in "..." strings; the latter works robustly from cmd.exe
pwsh.exe itself now has a -WorkingDirectory parameter, which therefore allows invoking the script with the -File parameter:

pwsh.exe -WorkingDirectory "C:\path 1" -Command "Start-Process -Verb RunAs pwsh.exe '-NoExit -ExecutionPolicy Bypass -File ""C:\path 1\setup 1.ps1""'"

Thank you. Your `"^""` solved the issue. Still sad to observe how, despite all their efforts, Microsoft is unable to give us a simple syntax to call an admin script. Something that in Linux would be as simple as `sudo '/path/to/setup'`. — antonio, Jan 17 '22 at 13:05

Santiago Squarzon · Answer 2 · 2023-04-22T14:34:03.007

Here you have an example of a script that checks if the process is running elevated and if it's not it attempts to start a new process elevated. There is no need to nest files or use CMD in this case.

This obviously comes with the caveat of an UAC prompt, as any other process that is started with elevated permissions.

$isAdmin = [System.Security.Principal.WindowsPrincipal]::new(
    [System.Security.Principal.WindowsIdentity]::GetCurrent()).
        IsInRole('Administrators')

if(-not $isAdmin) {
    $params = @{
        FilePath     = 'powershell' # or pwsh if Core
        Verb         = 'RunAs'
        ArgumentList = @(
            '-NoExit'
            '-ExecutionPolicy ByPass'
            '-File "{0}"' -f $PSCommandPath
        )
    }

    Start-Process @params
    return
}

"I'm elevated"
# Code goes here

Thank you, but, as mentioned in the question, I do not know in advance what the execution policies on the target computers could possibly be, and they could be set to restricted. — antonio, Jan 17 '22 at 12:38

Run a PowerShell script from a cmd batch as admin

2 Answers2

Linked