Task sequence run PowerShell script with alternate credentials

Question

I have a task sequence item that runs a PowerShell script in the later stage after the Config Manager client is installed. When I run that script using an alternate context for a domain user (with local admin rights), it fails to load the com object required to access task sequence variables.

$tsEnv = New-Object -ComObject Microsoft.SMS.TSEnvironment -ErrorAction Stop

This throws the following:

New-Object : Retrieving the COM class factory for component with CLSID {00000000-0000-0000-0000-000000000000} failed due to the following error: 80070005 Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)).

Anyone have an idea how to make that work, or is the instance only available to the local system context?

Answer 1

How I got around this was to write the Variables to the registry in a place the user account had access to. You could also output them to a file and then read them back in your other script.

You'll have to to do something creative to pull that information, as like you've discovered, you can't access the TS Environment when using "run as".

OR... You can pass them in to the script using parameters.

https://docs.recastsoftware.com/ConfigMgr-Docs/TaskSequence/SCCM_TaskSequence_Step_RunPowerShellScript.html

Check out the parameters section, you could pass them in like -OSDComputerName %OSDCOMPUTERNAME% -SMSTSPackageID %SMSTSPackageID

Answer 2

Thank you for the detailed response.