Powershell Script and Group Policy

Question

I wrote a powershell script that helpdesk uses to give user temporary access to a lockdown computer. We have a local temporary access group on the computer. A time stamp(file) is created. when a user is added.

I wrote a second script to remove the user from the group if timestamp is older than a day. The second script is added to a Group Policy at logon.

If I login to the workstation, users in the group older than a day are removed from the local group. I have admin rights. I am able to remove.

I would like the group to be cleaned up even if a non admin. Thanks for your help.

Answer 1

Are your timestamp files inheriting permissions from the directory, or are they assigned specific permission at the time they're created?

If they're inheriting the permissions, change the permissions at the directory. If you're assigning them specific permissions at creation time, change the code that creates the files.

Answer 2

I think you are right, permissions might be the issue here as deletion requires permissions.
You could consider setting up the 2nd script locally (push) or make it available through a share followed by creating a scheduled task which runs under the systems account with trigger "upon signin > each and every user"
Please let me know if this would work for you.

----------

If this helps, please accept the answer and upvote