windowspowershellcmdstart-processprocess-elevation

Start a non-elevated instance of "powershell.exe -NoProfile" from an elevated host/console


I'm trying to start a new, non-elevated instance of powershell.exe -NoProfile from an elevated PowerShell/ISE/pwsh/VSCode instance but haven't figured out a way to pass the -NoProfile switch in a way that results in a console that uses the custom colors/layout that it normally would when double-clicking powershell.exe from an Explorer window (e.g. a blue PowerShell console window).



Two popular approaches to lowering elevation from an elevated host/console:

  1. runas.exe /trustlevel:0x20000 powershell.exe
    • ISSUE: The console window doesn't use the custom layout/colors it typically displays with and will usually present as a black console window.
    • There is a SO question on the differences between the blue and black consoles here.
    • Lee Holmes also has a short blog about this.

  2. Taking advantage of explorer.exe's (default) lower trust level and doing something like this:
    Start-Process $env:SystemRoot\explorer.exe $PSHome\powershell.exe
    • ISSUE: If the user has disabled UAC, then explorer.exe will be running with elevation anyways, so this method isn't as reliable as using runas.exe /trustlevel:0x20000 powershell.exe




I've tried:




Editing the registry to modify the default console layout/colors isn't impossible, but it's not the most practical solution. Is there another approach that would work better?


Solution

  • The simplest way to work around this is to call via cmd /c start in order to start a new window - either relying on the new window's target executable's path to select the right settings or by specifying an explicit startup title:

    runas /trustlevel:0x20000 'cmd /c start powershell.exe -noprofile'
    

    Note: