Allow user to add Snap-In in Powershell on Windows Server 2012 RC2

Question

I have a user that is used to run Powershell scripts, triggered by the Windows task scheduler on a Windows 2012RC2 server. The scripts use specific Snap-ins, which are added at the start of the script.

The scripts fail and when I manually tried to find the root cause of the issue by running a Powershell on the server as said user, I found out that the user is unable to add the snap-in:

asnp <snap-in>
+ asnp <snap-in>
+ ~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (<snap-in>:String) [Add-PSSnapin], PSArgumentException
    + FullyQualifiedErrorId : AddPSSnapInRead,Microsoft.PowerShell.Commands.AddPSSnapinCommand

It works fine if I run the same command in the Powershell as the Administrator.

How do I permit the user to add snap-ins in the Powershell on the server?

Have you tried to configure the task to run with the "highest privileges"? — John K. N., Oct 28 '16 at 11:13
I didn't see that option! Thanks for the hint. The task is currently running, I'll retry once it's done, without local admin rights. — SaAtomic, Oct 28 '16 at 11:19

score 0 · Accepted Answer · answered Oct 28 '16 at 06:07

0

Looks like the snap-in is not available to the user, either because it was not installed correctly, or because it was placed in a location restricted to administrators (or specific to Administrator only).

Have a look here as a starting point, and then try using get-pssnapin -registered to check whether the snap-in is indeed registered and available; try running the command both as Administrator and as the troubled user.

See also here about registering snap-ins.

answered Oct 28 '16 at 06:07

Massimo

70,200
57
200
323

`get-pssnapin -registered` returns nothing with the user in question and the required snap-in with the Administrator, so that seems to be the issue. Trying to register the `.dll`, but I don't seem to have the `installutil` in `C:\Windows\Microsoft.NET\Framework\v2.0.50727`. – SaAtomic Oct 28 '16 at 06:20
oh wow. the user didn't have the permissions to register the snap-in. I've now added the user to the local administrators and it seems to work. If you happen to know how I can allow the user to register the dll without local admin rights, I'd be happy though! – SaAtomic Oct 28 '16 at 06:29
This is strange, the registration should be global (that's the whole point of needing administrative rights to perform it). Anyway, after the snap-in is registered, the user no longer needs administrive rights to actually use it. – Massimo Oct 28 '16 at 06:41
Once I added the user to the local Administrators, the snap-in was already registered.. – SaAtomic Oct 28 '16 at 07:03

Allow user to add Snap-In in Powershell on Windows Server 2012 RC2

1 Answers1