Using a powershell script as a logon script (group policy) which starts a external program?

Question

I have made a power shell script which loads pageant (a windows SSH authentication agent) with my private keys. In short the script isn't much more than the following two lines:

$tool = "pageant.exe"
&$tool $files.ToArray()

$files is a list of strings which contains all my private keys which must be loaded.

I have no problem with the working of the script because it does its job perfectly when I execute this from my powershell console.

I want to execute this script whenever I logon to my account and I do this by adding a powershell logon script group policy with the group policy editor (gpedit.msc), the script also executes and in fact does load the pageant.exe tool.

However the tools utilising the pageant.exe tool (putty and plink) does not work. It doesn't recognizes the pageant authentication agent.

So my first question is, what is the difference between starting the script from my own powershell console and starting the script from a group policy (logon script)?

I also have dome some investigation and I see a couple of differences. The first is thing is that the started pageant tool has a UAC Virtualization flag in my task manager when I start the script from my own console. This property isn't flagged when it's started from the logon script group policy.

The second thing is that when I disable the UAC the script does work from the logon script group policy. So I assume it has something to do with the UAC but I don't know how to solve this. I want the script to work when the UAC is enabled as well.

The second question what is this UAC virtualization flag and how does it influence the working of a process? The third and last question is how can I get my script working?

Answer 1

For completeness I added the answers to my own questions.

1. What is the difference between starting the script from my own powershell console and starting the script from a group policy (logon script)?

   A: The difference comes from the fact that my user is part of the Administrator group which will run the script with elevated rights. When you logon as a administrator, Windows will generate a standard user access token and a administrators access token. The last token will be used to run programs with elevated rights (this is without UAC virtualization). Now when I start the script from my own powershell console, which is started with the standard access token, the started pageant is run with UAC virtualization. If the tools which use pageant run with a different mode, then my problem occurs.

2. What is this UAC virtualization flag and how does it influence the working of a process?

   A: Check out this link.

3. How can I get my script to work?

   A: You can use the solution provided by Kate Gregory (do not check run with highest privilege option) or add a batch file to your startup folder which runs the powershell script. This will run the script with the standard user access token and with UAC virtualization enabled.

Answer 2

It looks the thing is UAC virtualization. This flag means that all write attempts to protected system areas are redirected to VirtualStore in the user's profile: C:\Users\<username>\AppData\Local\VirtualStore. When UAC is disabled, this redirection is turned off.

When UAC is enabled, any attempts to write to Program Files, as an example, will be redirected to the corresponding directory in your VirtualStore. Later when programs read the files, they also see them from the redirected directory.

Yet your logon script runs without Virtualization enabled, and therefore its attempts to modify/read files do not go to the redirected VirtualStore but rather directly to Program Files.

So you have to make all your parties work without virtualized directories. If the executable has a manifest, preferrably declaring compatibility with Windows 7, then virtualization is turned off. But it may fail to work correctly without virtualization if it tries to write to Program Files.

Note: registry writes to HKLM are also virtualized.

Answer 3

There are a number of ways to turn off UAC virtualization; the simplest is to include an external manifest (in your case it would be named pageant.exe.manifest) in the same folder as the exe. This could suppress elevation, but then your writes would probably fail. The very fact that virtualization is affecting you means that pageant.exe must write to protected areas, and without virtualization or elevation, you'll get access denied.

Therefore what I would do is leave Group Policy out of it. Set up a Scheduled Task (click Start and type Task to launch task scheduler, then click Create Task on the right) that runs at logon (the Trigger tab, click new, change the top dropdown) to run your script (Actions tab, click new) and that runs elevated (General tab, check Run with highest privileges). You'll have to consent once to the UAC to set up the elevated task. Then you're done and pageant.exe will write to the protected area where the other apps can read it.

If, after you've got this set up, the other apps continue to read from the virtual store instead of the real one, just delete the files/folders in the virtual store.