document.write('\
\ "); document.write('
  1. # Version History
    2. \
  2. # 1.1 - Added aliases, error handling, help, and cleanup
    3. \
  3.  
    4. \
  4. $MyInvocation.MyCommand.ScriptBlock.Module.OnRemove = {
    5. \
  5.    while($script:ImpContextStack.Count) { Pop-ImpersonationContext }
    6. \
  6. }
    7. \
  7.  
    8. \
  8. $script:UserToysClass = Add-Type -Namespace Huddled -Name UserToys -MemberDefinition @"
    9. \
  9.   // http://msdn.microsoft.com/en-us/library/aa378184.aspx
    10. \
  10.   [DllImport("advapi32.dll", SetLastError = true)]
    11. \
  11.   public static extern bool LogonUser(string lpszUsername, string lpszDomain, string lpszPassword, int dwLogonType, int dwLogonProvider, ref IntPtr phToken);
    12. \
  12.  
    13. \
  13.   // http://msdn.microsoft.com/en-us/library/aa379317.aspx
    14. \
  14.   [DllImport("advapi32.dll", SetLastError=true)]
    15. \
  15.   public static extern bool RevertToSelf();
    16. \
  16. "@ -passthru
    17. \
  17.  
    18. \
  18. $script:ImpContextStack = new-object System.Collections.Generic.Stack[System.Security.Principal.WindowsImpersonationContext]
    19. \
  19. $script:IdStack = new-object System.Collections.Generic.Stack[System.Security.Principal.WindowsIdentity]
    20. \
  20.  
    21. \
  21. function Push-ImpersonationContext {
    22. \
  22. <#
    23. \
  23. .SYNOPSIS
    24. \
  24.    Sets the network credentials for the current thread
    25. \
  25. .Description
    26. \
  26.    Stores an identity on the stack and impersonate it for network connections
    27. \
  27. .Parameter Credential
    28. \
  28.    Credentials for authenticating as a new identity.
    29. \
  29. .Parameter Name
    30. \
  30.    A user name for authenticating as a new identity.
    31. \
  31. .Parameter Password
    32. \
  32.    The password (as a String or SecureString) for authenticating as a new identity
    33. \
  33. .Parameter Domain
    34. \
  34.    The domain which goes with the user name for authentication. This is optional, as you can specify a domain or computer name as part of the name using domain\\user or user@domain syntax.
    35. \
  35. .Parameter Passthru
    36. \
  36.    Causes Push-ImpersonationContext to output the WindowsIdentity that it\'s impersonating (not the impersonation context).
    37. \
  37. .Example
    38. \
  38.    Push-ImpersonationContext (Get-Credential)
    39. \
  39. .Example
    40. \
  40.    Push-ImpersonationContext username@domain (Read-Host "Password" -AsSecureString)
    41. \
  41. .Example
    42. \
  42.    $Domain1 = Get-Credential
    43. \
  43.    $Id1 = PushIC $Domain1 -Passthru
    44. \
  44. #>
    45. \
  45. [CmdletBinding(DefaultParameterSetName="Credential")]
    46. \
  46. Param(
    47. \
  47.    [Parameter(Position=0,Mandatory=$true,ParameterSetName="Credential")]
    48. \
  48.    [System.Management.Automation.PSCredential]$Credential
    49. \
  49. ,
    50. \
  50.    [Parameter(Position=0,Mandatory=$true,ParameterSetName="Identity")]
    51. \
  51.    [Security.Principal.WindowsIdentity]$Identity
    52. \
  52. ,
    53. \
  53.    [Parameter(Position=0,Mandatory=$true,ParameterSetName="Password")]
    54. \
  54.    [string]$Name
    55. \
  55. ,
    56. \
  56.    [Parameter(Position=1,Mandatory=$true,ParameterSetName="Password")]
    57. \
  57.    [Alias("PW")]
    58. \
  58.    $Password = (Read-Host "Password" -AsSecureString)
    59. \
  59. ,
    60. \
  60.    [Parameter(Position=2,Mandatory=$false,ParameterSetName="Password")]
    61. \
  61.    [string]$Domain
    62. \
  62. ,
    63. \
  63.    [Alias("PT")]
    64. \
  64.    [switch]$Passthru
    65. \
  65. )
    66. \
  66.    if(!$Identity) {
    67. \
  67.       if(!$Credential) {
    68. \
  68.          if($password -is [string]) {
    69. \
  69.             $secure = New-Object System.Security.SecureString
    70. \
  70.             $password.GetEnumerator() | %{ $secure.AppendChar( $_ ) }
    71. \
  71.             $password = $secure
    72. \
  72.          }
    73. \
  73.          if($domain) {
    74. \
  74.             $user = "${name}@${domain}"
    75. \
  75.          }
    76. \
  76.          $Credential = new-object System.Management.Automation.PSCredential $user, $password
    77. \
  77.       }
    78. \
  78.  
    79. \
  79.       Write-Verbose ([Security.Principal.WindowsIdentity]::GetCurrent() | Format-Table Name, Token, User, Groups -Auto | Out-String)
    80. \
  80.  
    81. \
  81.       [IntPtr]$userToken = [Security.Principal.WindowsIdentity]::GetCurrent().Token
    82. \
  82.       if(!$UserToysClass::LogonUser(
    83. \
  83.             $Credential.GetNetworkCredential().UserName,
    84. \
  84.             $Credential.GetNetworkCredential().Domain,
    85. \
  85.             $Credential.GetNetworkCredential().Password, 9, 0, [ref]$userToken)
    86. \
  86.       ) {
    87. \
  87.          throw (new-object System.ComponentModel.Win32Exception( [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() ) )
    88. \
  88.       }
    89. \
  89.  
    90. \
  90.       $Identity = New-Object Security.Principal.WindowsIdentity $userToken
    91. \
  91.    }
    92. \
  92.    $script:IdStack.Push( $Identity )
    93. \
  93.    
    94. \
  94.    $context = $Identity.Impersonate()
    95. \
  95.    $null = $script:ImpContextStack.Push( $context )
    96. \
  96.  
    97. \
  97.    Write-Verbose ([Security.Principal.WindowsIdentity]::GetCurrent() | Format-Table Name, Token, User, Groups -Auto | Out-String)
    98. \
  98.    
    99. \
  99.    if($Passthru) { $script:IdStack.Peek() }
    100. \
  100. }
    101. \
  101.  
    102. \
  102. function Pop-ImpersonationContext {
    103. \
  103. <#
    104. \
  104. .Synopsis
    105. \
  105.    Remove the current impersonation context from the stack and clean it up
    106. \
  106. .Description
    107. \
  107.    Pops the current impersonation context from the stack and undo and dispose it, leaving the former context in place.
    108. \
  108. .Param Passthru
    109. \
  109.    Output the old WindowsIdentity before popping it.
    110. \
  110. #>
    111. \
  111.    param( [switch]$Passthru )
    112. \
  112.    trap {
    113. \
  113.       Write-Error "Impersonation Context Stack is Empty"
    114. \
  114.       while($script:ImpContextStack.Count -lt $script:IdStack.Count) { $null = $script:IdStack.Pop() }
    115. \
  115.       return
    116. \
  116.    }
    117. \
  117.    if($Passthru) { $script:IdStack.Peek() }
    118. \
  118.    $context = $script:ImpContextStack.Pop()
    119. \
  119.    $null = $script:IdStack.Pop()
    120. \
  120.    
    121. \
  121.    $context.Undo();
    122. \
  122.    $context.Dispose();
    123. \
  123. }
    124. \
  124.  
    125. \
  125. function Get-ImpersonationContext {
    126. \
  126. <#
    127. \
  127. .Synopsis
    128. \
  128.    Display the currently active WindowsIdentity
    129. \
  129. #>
    130. \
  130.    trap {
    131. \
  131.       Write-Error "Impersonation Context Stack is Empty"
    132. \
  132.       return
    133. \
  133.    }
    134. \
  134.    Write-Host "There are $($script:ImpContextStack.Count) contexts on the stack"
    135. \
  135.    while($script:ImpContextStack.Count -lt $script:IdStack.Count) { $null = $script:IdStack.Pop() }
    136. \
  136.    if($script:ImpContextStack.Count -eq $script:IdStack.Count) {
    137. \
  137.       $script:IdStack.Peek()
    138. \
  138.    }
    139. \
  139. }
    140. \
  140.  
    141. \
  141. New-Alias popic Pop-ImpersonationContext
    142. \
  142. New-Alias pushic Push-ImpersonationContext
    143. \
  143. New-Alias gic Get-ImpersonationContext
    144. \
  144. Export-ModuleMember -Function * -Alias *
    145. \
');document.write('
downloadThis Script brought to you by PoshCode\
\
\
');