RunAs-NetOnly

RunAs-NetOnly

 Add-Type -TypeDefinition @"
    using System;
    using System.Runtime.InteropServices;
    using System.Security.Principal;
    public static class Advapi32
    {
        [DllImport("advapi32.dll", SetLastError = true)]
        public static extern bool LogonUser(string pszUsername, string pszDomain, string pszPassword, int dwLogonType, int dwLogonProvider, ref IntPtr phToken);

        [DllImport("advapi32.dll", SetLastError=true)]
        public static extern bool ImpersonateLoggedOnUser(IntPtr hToken);
    }
"@

$LogonTokenHandle = [IntPtr]::Zero
[Advapi32]::LogonUser("user","domain","password",9,0,[ref]$LogonTokenHandle)
[Advapi32]::ImpersonateLoggedOnUser($LogonTokenHandle)
[System.Security.Principal.WindowsIdentity]::Impersonate($LogonTokenHandle)

dir \\dc1\c$   # THIS WORKS AND SENDS CORRECT RUNAS USER

get-process -computername dc1      # THIS WORKS AND SENDS CORRECT RUNAS USER

Invoke-WmiMethod -Path Win32_process -Name create -ComputerName 'dc1' -ArgumentList 'calc.exe'     # THIS DOESNT WORK AND SENDS WRONG USER - ACCESS DENIED 0x80070005

Get-WmiObject -Namespace "root\cimv2" -Class Win32_Process -Impersonation 3 -ComputerName dc1      # THIS DOESNT WORK AND SENDS WRONG USER - ACCESS DENIED 0x80070005