v4.1.7-Start-ADTProcessAsUser failing in Intune with -196608

The Toolkit General Discussion
1

Hey Guys
PSADT 4 newb here. I am really stuck on this one.
I am using v4.1.7 and basically what I am trying, is to run the application as System and call a Powershell-Script as User that displays a UI Window to the logged in user. I have RequireAdmin set to true, because the rest of the PSADT Script does require elevation. The popup does not.

This works perfectly locally, no matter if I execute as Admin or as System (via psexec). It does exactly what I intended.

Now once i throw it into a win32 and deploy via intune (as System), I always get the one same error:
[Install] :: Failed to execute popup script via Start-ADTProcessAsUser: Execution failed with exit code [-196608].

I can't find anything to this Errorcode :man_shrugging:
Intune seems to treat Start-ADTProcessAsUser differently. Any Ideas what could be at fault here?

Below the code:

    $popupScript = Join-Path -Path $adtSession.DirFiles -ChildPath 'Popup.ps1'
    
    try {
        # Launch the popup script in the user's session
        Write-ADTLogEntry -Message "Launching popup script for user: $($adtSession.RunAsActiveUser.UserName)" -Severity 1
        
        $processResult = Start-ADTProcessAsUser `
            -Username $RunAsActiveUser.UserName `
            -FilePath $pwshExe `
            -ArgumentList "-ExecutionPolicy Bypass -NoProfile -File `"$popupScript`"" `
            -WindowStyle Normal `
            -PassThru

        # Capture the exit code
        $exitCode = $processResult.ExitCode
        Write-ADTLogEntry -Message "Popup script completed with exit code: $exitCode" -Severity 1
    }
    catch {
        Write-ADTLogEntry -Message "Failed to execute popup script via Start-ADTProcessAsUser: $_" -Severity 3
        $exitCode = 1
    }

This exact Script used to work with ServiceUI

.\ServiceUI.exe -process:Explorer.exe "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Ex bypass -file "$PSScriptRoot\Popup.ps1"
$exitCode = $LASTEXITCODE
2

I understand that you are running your deployment as SYSTEM, but you are spawning your $popupscript (popup.ps1) as the ActiveUser (assumed to not be an admin), where as you previously ran the script as SYSTEM, but by using ServiceUI.exe you displayed the (SYSTEM) output to the active user.

I suspect that you do not need to run the $popupscript (popup.ps1) as the ActiveUser, but instead just call (launch) the script from within your PSADT script, this way the script will run in the same context as the deployment (SYSTEM), but PSADT will display the output from your script to the logged on user

[EDIT]
Sorry I have just re-read that and I'm not sure if that make sense, apologies, but at the moment I'm unsure how to make it clearer :laughing:

3

Hi, I believe it might be an access issue, that the popup script can't be accessed from the users session. Have you tried copying the script so another path and run it from there?

4

No worries, I got you :slight_smile:
Yes the user is not an Admin. How would I launch it just normally in System context? With Start-ADTProcess? I thought since I am running in SYSTEM context, PSADT won't be able to display anything to the user (since I am guessing it would display it to the SYSTEM "User" which is not logged in). At least this was my understanding. I did try to build it with Start-ADTProcess, but there I run into this error:

Exception calling "ShowDialog" with "0" argument(s): "Showing a modal dialog box or form when the application is not
running in UserInteractive mode is not a valid operation. Specify the ServiceNotification or DefaultDesktopOnly style
to display a notification from a service application."
At C:\WINDOWS\IMECache\a53e157c-fdcd-47b8-a6e3-0d2174e9d72f_1\Files\Popup.ps1:1873 char:1
+ $formBlockerStartUpIn.ShowDialog() | Out-Null
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : InvalidOperationException
5

Hmm, I had also already played with this thought. But why does it work if I run it locally? The script even executes if I run it as non-admin User and I see the popup UI. (The Issue is just that later in the script PS Commands require adminrights, otherwise I would just deploy it in Usermode, which gave me the same results as running it locally with the user).

EDIT: Right Intune uses the cache directory.. ups. I will give this a try and report back :+1:

6

The installation is already in the user's security context.

You should be able to use an idea from an old post and do this:

Try {
   $PathToPs1File = "$($adtSession.DirFiles)\Popup.ps1"
   &$PathToPs1File
} Catch {
   Invoke-ADTFunctionErrorHandler -Cmdlet 'MyPopupScript' -SessionState $ExecutionContext.SessionState -ErrorRecord $_ -LogMessage "The Popup Script failed to run"
}
7

This was the Issue. Copying the file to a user accessible location solved the error. Simple fix.
Thank you @JFP