Copy-Item permission denied PowerShell WF
hello, have simple powershell wf:
workflow gather-securitylogs {
parallel {
sequence {
inlinescript {
cmd /k 'wevtutil epl security /q:"*[system[timecreated[timediff(@systemtime) < = 7862400000]]]" c:\%computername%.evtx /ow:true'
}
copy-item c:\output.evtx \\dc\share\$pscomputername.evtx
}
}
}
copy-item errors out permission denied. i'm using domain admin account, elevated powershell, granted full access share , full security permissions... no good. ideas?
ps. copy-item works flawlessly outside powershell wf
the data above text pseudorandom, brace yourselves.
workflow gather-securitylogs {
$user = 'xxxxx'
$plainpassword = 'xxxxx'
$securepassword = $plainpassword | convertto-securestring -asplaintext -force
$cred = new-object system.management.automation.pscredential -argumentlist $user, $securepassword
parallel {
sequence {
inlinescript {
cmd /k 'wevtutil epl security /q:"*[system[timecreated[timediff(@systemtime) < = 7862400000]]]" c:\%computername%.evtx /ow:true'
new-psdrive -name x -psprovider filesystem -root "\\msk-dc-02\c$" -credential $using:cred
copy-item c:\$pscomputername.evtx x:\$pscomputername.evtx
remove-psdrive -name x
}
}
}
}
works this, or can try anonymous auth (perhaps)
the data above text pseudorandom, brace yourselves.
Windows Server > Windows PowerShell
Comments
Post a Comment