Show terminal when running powershell as admin

[jibbers42]

When using the code provided in the documentation to run a script as admin, is it possible to have the terminal open in UI so you can observe output and interact with scripts that ask questions?

I'm using Windows Terminal Version: 1.12.10393.0

If it makes any difference, mine code is slightly modified to run pwsh.exe instead of powershell.exe.

if (-Not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] 'Administrator')) {
  if ([int](Get-CimInstance -Class Win32_OperatingSystem | Select-Object -ExpandProperty BuildNumber) -ge 6000) {
    $CommandLine = "-NoExit -File `"" + $MyInvocation.MyCommand.Path + "`" " + $MyInvocation.UnboundArguments
    Start-Process -FilePath pwsh.exe -Verb Runas -ArgumentList $CommandLine
    Exit
  }
}

[twpayne]

I'm not very familiar with Windows, but chezmoi connects the standard input, output, and error when running scripts on all operating systems, including Windows. This should mean that interactive programs invoked from scripts should "just work".

Could you give a specific example of a run_ script that should be interactive but is not when executed through chezmoi?

[jibbers42]

This is a bit contrived, but...

# Self-elevate the script if required
if (-Not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] 'Administrator')) {
  if ([int](Get-CimInstance -Class Win32_OperatingSystem | Select-Object -ExpandProperty BuildNumber) -ge 6000) {
    $CommandLine = "-NoExit -File `"" + $MyInvocation.MyCommand.Path + "`" " + $MyInvocation.UnboundArguments
    Start-Process -FilePath pwsh.exe -Verb Runas -ArgumentList $CommandLine
    Exit
  }
}

Set-ExecutionPolicy RemoteSigned -Confirm

Write-Output 'Press any key to continue...'
[void][System.Console]::ReadKey($true)

and then

> chezmoi.exe apply .chezmoiscripts/ps_as_admin.ps1

I get the prompt to elevate and then a new window opens to presumably run the script, but it closes too fast to read what the output is (even with the ReadKey). I really just wanted to know in case I needed it one day. Since opening this ticket I've learned that you can put #Requires -RunAsAdministrator in your script and it will fail, allowing you a chance to manually start an elevated prompt and try again.

[zb140]

On Windows, the experience of a script elevating its own privileges leaves a lot to be desired. Because of how the console subsystem works on Windows, a solution using Start-Process -Verb runas like this will behave like you're seeing: it spawns a new terminal, which will then close as soon as it's done. It doesn't have the same stdout/stdin as the parent, so input and output are separated from the process that originally launched the script.

(Side note: I'm a little surprised that your ReadKey example didn't keep the new, elevated terminal alive long enough to see it and press a key. I haven't totally wrapped my head around why that doesn't work yet.)

I don't think there's a really good way to fix this experience using only built-in solutions, unfortunately. If you're willing to install a third-party tool, you might consider using https://github.com/gerardog/gsudo. It can seamlessly launch commands with elevated privileges but without spawning a new terminal, but it has its own tradeoffs. For single commands, you can just toss gsudo in front and it will work, including interactive tools using stdin/stdout. To elevate an entire script, you can use the Invoke-gsudo cmdlet it provides, but unfortunately that runs PowerShell with the -NonInteractive flag, so you can't read user input. (Full disclosure: I only just found out about Invoke-gsudo when I went to get the link to post in this reply, so I haven't played with it much. There may be a way to allow interactivity. But I've used gsudo for a while for elevating single commands in scripts and so far I've been very happy with it.)

[jibbers42]

I was surprised about ReadKey not working too. Thanks for the in-depth reply and the tip on gsudo! I actually saw that mentioned in another thread on here (maybe by you, not sure), but just skimmed it and didn't realize what it was. I think I mentally confused it with the old gksu and just moved on before understanding the context.