Powershell: How to run Invoke-DscResource in any context

[mkht]

Summary of the new feature/enhancement

I think one of the obstacles in migrating an existing DSC configuration that relies on Windows LCM to a configuration using Invoke-DscResource is the difference in execution context.

While with LCM it runs in the system context by default and can be switched to any user context using the PsDscRunAsCredential common parameter, Invoke-DscResource runs in the context of the executing user and does not have the ability to switch contexts.

Are there plans to implement a better way to execute DSC resource in any context, including system account?

[daxian-dbw]

/cc @TravisEz13 for insights.

[TravisEz13]

@mkht You can run Invoke-DscResource in another context like you can run any other command, using Invoke-Command which allows you to run in your specified context.

Otherwise, I don't think this is part of the current plan.

Understanding, how and why this would be needed and the current available features don't meet your need would be useful.

[mkht]

@TravisEz13
Thanks for the answer.

I thought it would be useful to add a parameter like -RunAs to Invoke-DscResouce, but if you mean that it should be wrapped in Invoke-Command, I get it.

An additional question: is there a way to use Invoke-Command to run commands as a system account?
I know I can use psexec.exe, but I don't think it's easy to use in PowerShell.

[vexx32]

@mkht you can't use the default Invoke-Command to do that. Running as SYSTEM requires some additional hoop-jumping. Once of the more reliable methods is to create a scheduled task that runs as SYSTEM and invoke that.

There's a module called Invoke-CommandAs on the powershell gallery that will handle all the difficult bits for that if you'd like a pre-built solution, it'll support running as SYSTEM or any other user you can provide credentials for, if I recall correctly. 🙂

[mkht]

@vexx32 Thanks for telling me about the Invoke-CommandAs module. It looks good. I'll try it.

Honestly, I'm not going to move to Invoke-DscResource anytime soon as I have an existing system that relies on LCM-DSC.
But I'm happy to see the PowerShell team and DSCCommunity continue to invest in DSC and make various improvements to it. 👍

My question is resolved. I will close this issue.