Run powershell on remote machine without enabling powershell remoting !

Here is a tricky way to execute powershell code on remote machine without actually enabling powershell remoting. Enabling powershell remote lets you run powershell commands on a remote machine and get the output on to your computer.

You can either use the -ComputerName parameter available in a command or use the Invoke-Command using the -Computer parameter, or create a psremoting session and run the Invoke-Command on the session.

If PSRemoting is not enabled on your environment you do not have any way to run powershell script on a remote machine.

I was creating a remote software installation tool using powershell which wraps the PsExec tool and lets you install a software on remote machine if you know the silent installation commandlines. With a slight modification same tool can be used for running a script on the remote machine and get the outputs.

PSExec redirects the output onto your screen but if you create an output file on the remote machine you need to figure a way to get it copied onto your local machine from the remote machine, or create a share in your localmachine/server to which you can save the output from the remote machine.

Script uses the cmdkey to cache the credentials and maps the remote machine C drive to copy the setup files.

Creates a folder in C drive on the remote machine, copies the ps1 file you want to run along with a batch file which triggers the powershell script.

Once the script execution is completed on the remote machine, mapped network drive and cached credentials will be deleted.

GUI creation credit to following blog.
Download psexec and save it in the same folder where you have the main script.

The below script can be run using the remote machine name and the ps file source folder name.

Here is how your script folder should look like.

Before running the script, want to show that the remote machine has a restricted powershell execution policy and PSremoting is not enabled(Screenshot1).

Below  script would be run on this machine from a different machine.

$process = Get-Process

$process

Write-Host "Also writing output to file on remote machine check C:\temp\lanabhat.txt"

$process | Out-File C:\temp\Lanabhat.txt

 

How to run the script.

Commandline entered in the installCommand.bat file
powershell -ExecutionPolicy ByPass C:\Software_Install\test-remoteShare.ps1

Running the powershell script.
.\Run-PowershellRemote.ps1 -MachineName PC0001 -installSourceFiles C:\Users\lanabhat\Desktop\Remote-Powershell\test-powershellscript

Credentials to connect to the remote machine, username would default to COMPUTARENAME\Administrator , if you have a service account or a domain admin account, you can modify the code and replace it to default to that value.

Remote machine C drive is mapped to P drive a folder is created to batch file and powershell script is copied to that folder and batch file is executed with system account.

Credential will be cached to connect to run psexec on remote machine. It will be removed at the end.

Output of the script is shown in your machine but the script is running on the remote machine.

Once the execution is completed press enter to do clean-up. Files copied to remote machine will be deleted and shared folder will be unmapped.

Here is the result from the remote machine.

And finally here is the script.

Please share your feedback and send me a message if you find it useful !

<#
.Synopsis
   Run powershell script on remote machine using psexec
.DESCRIPTION
   Copies the setup files specified in the source.
   This script runs the commandline from the installCommand.bat file on remote machine.
   Copies the setup files to remote machine
   Executes the installation.
.EXAMPLE
   .\Run-PowershellScript.ps1 -MachineName "hostname1" -installSourceFiles \\sharename\foldername -Verbose
.EXAMPLE
   .\Run-PowershellScript -MachineName "hostname2" -installSourceFiles \\sharename\foldername -Verbose
 
#>

    [CmdletBinding()]

    

    Param

    (

        #Machine Name

        [Parameter(Mandatory=$true,

                   ValueFromPipelineByPropertyName=$true,

                   Position=0)]

        $MachineName,

        #Shared folder location of setup.

        [Parameter(Mandatory=$true,

                   ValueFromPipelineByPropertyName=$true,

                   Position=1)]

        $installSourceFiles

     )

#region functions

Function Get-RandomDriveLetter

{

$drive=ls function:[d-z]: -n|?{!(test-path $_)}|random

$dl=($drive.ToString()).Replace(":","")

$dl

}

Function map-Drive($driveLetter,$networkDrive,$creds)

{

  $errorFlag = $false

  $net = new-object -ComObject WScript.Network

  

  Write-Verbose "Drive letter $driveLetter"

  Write-Verbose "Network share $networkDrive"

  

  $user_cred = $creds #Get-Credential -Message "Enter the admin cred to map C: drive" $userID

  if($user_cred -eq $null)

  {

   "Credentials were not entered, cannot proceed"

   return 0

  }

  

   $networkCred = $user_cred.GetNetworkCredential()

   $password=$networkCred.Password

   $userID=$networkCred.Domain + "\" + $networkCred.UserName

   $driveLetter += ":"

  

   try

   {

    $net.MapNetworkDrive($driveLetter,$networkDrive,$false,$userID,$password)

   }

   catch

   {    

    $errorFlag = $true

    $ErrorMessage = $_.Exception.Message

    if($ErrorMessage -match "The specified network password is not correct")

    {

     Write-Host "Invalid credentials" -ForegroundColor Yellow

    }

    else

    {

     Write-Host "Invalid credentials" -ForegroundColor Yellow

    }

    exit 0

}

}

#Unmap the network drive

Function Unmap-NetworkDrive($driveLet)

{

  Remove-PSDrive -Name $driveLet

}

function Cache-Creds($hostname,$username,$password)

{

  cmdkey.exe /add:$hostname /user:$userName /pass:$password

}

function Remove-CacheCred($hostname)

{

cmdkey.exe /delete:$hostname

}

#endregion functions

$localSetup = "Software_Install" #Local folder which will be created on C drive on user machine

$batchFile = "$($Script:PSScriptRoot)\installCommand.bat" #Command file which will be copied to user machine

$remoteBatchPath = "C:\$($localSetup)\installCommand.bat"

#create a batch file as per the script argument

Write-Verbose "Commandline used is: $commandLine"

$hostname =  $MachineName

$userName = "$($hostname)\administrator"

$credential=Get-Credential $userName -Message "Please center the password to access the remote machine"

$password = $credential.GetNetworkCredential().Password;

#Create a cached credentials for psexec connection

Cache-Creds $hostname $username $password

$remMachinedriveLetter = Get-RandomDriveLetter

$sharePath = "\\$($hostname)\C$"

#Map the remote machine C drive

map-Drive $remMachinedriveLetter $sharePath $credential

#Created SCCM_Install folder on c drive, if it does not exists

if(!(Test-Path "$($remMachinedriveLetter):\$localSetup"))

{

Write-Verbose "Directory not found on remote server, creating the directory: $($remMachinedriveLetter):\$localSetup"

New-Item -path "$($remMachinedriveLetter):\$localSetup" -ItemType Directory

}

#Copy setup files to remote machine

Write-Verbose "Copying setup files from $installSourceFiles"

Copy-Item "$($installSourceFiles)\*" "$($remMachinedriveLetter):\$localSetup\" -Recurse -Verbose -Force -Container

Write-Verbose "Copying batchfile : $batchFile"

Copy-Item $batchFile "$($remMachinedriveLetter):\$localSetup\" -Verbose

#run psexec and launch install

Write-Verbose "Running PSEXEC to trigger the batch"

& .\psexec.exe \\$hostname -h -s $remoteBatchPath

Write-Host "Exitcode:" -ForegroundColor Yellow

$LASTEXITCODE

#Unmap network drive, cleanup

Write-Verbose "Removing Cached Creds"

Remove-CacheCred $hostname

Read-Host "Press enter to do cleanup"

Write-Verbose "Deleting installation files"

Remove-Item "$($remMachinedriveLetter):\$localSetup" -Recurse -Verbose

Write-Verbose "Removing network drive"

Unmap-NetworkDrive -driveLet $remMachinedriveLetter

Coming next -

Remote software installer, merging the power of powershell and psexec....