Run Script under different user - always
the ideal way use powershell remoting. can create constrained endpoint can have access control (only allowing desk staff / etc connect), and runs commands in remoting session service account's credentials (which never have exposed client computer in form), , exposes commands , functionality need desk have.
by contrast, if try encrypt set of credentials , have desk staff run script uses credentials, have absolutely no way of preventing staff members obtaining plain-text credentials. if user able run script, they're able read encrypted data. remoting , constrained endpoints, not case.
jeffrey snover's been developing , presenting new powershell toolkit called jea (just enough admin), takes concept , turns 11.
Windows Server > Windows PowerShell
Comments
Post a Comment