title: How to run w32tm in non-elevated powershell
body: <p>I am writing a helper script that will go through a list of servers and verify they are in sync with the NTP. The script shall be run as a normal script on request by the facility operator and shall request for Admin credentials if the target is not in sync. We unfortunately cannot change the NTP configuration at the moment so we have to make workaround.</p>
  
  <p>What I have right now (and it works beautifully if the script is run as administrator) is a command ("w32tm /query /status" of a remote computer) that is executed via "Invoke-Command" so I can pass it Admin credentials. </p>
  
  <p>My idea was to avoid using WinRM since the hostname resolution is not working properly in our system (it requires some painful host-to-IP-and-back-to-proper-hostname resolution) which makes the WinRM useless. </p>
  
  <p>The command w32tm can obtain status of a remote computer but it needs to be run as administrator for it. </p>
  
  <p>In both cases (run as administrator and run as normal user and later providing the credentials) the $script is executed as domain\administrator (confirmed with the check of Admin role and the "WhoAmI" command) but the status is only obtained when the whole script is executed as administrator. 
  For the execution as normal user I receive the error:</p>
  
  <pre><code>The following error occurred: Access is denied. (0x80070005)
  </code></pre>
  
  <p>All machines I use obviously allow remote execution since it works with administrator user. </p>
  
  <p>So basically my question is why is the "w32tm ..." command not allowed in the $script if the role of the user is appropriate (it is administrator role) for the task?</p>
  
  <p>The part of the script which I can't resolve:</p>
  
  <pre><code>function synchronize_remote_machine ($target, $username, $cred)
  {
      $script = { 
          param( [String] $compName )
  
          $user = [Security.Principal.WindowsIdentity]::GetCurrent();
          $userIsAdmin = (New-Object Security.Principal.WindowsPrincipal $user).`
                  IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)  
  
          if (-not $userIsAdmin)
          {
              Write-Warning "You do not have Administrator rights to run this script!`n
                      Please re-run this script as an Administrator!"
          }
          else    
          {
              whoAmI
              w32tm /query /status /computer:$compName
              #w32tm /resync /rediscover /computer:$compName
          }
      }
  
      # resync via WinRM
      try 
      {
          #execute_resync_command $target $username $cred
          if ($username -eq 'Administrator')
          {
              # when run as admin
              invoke-command -ScriptBlock $script -ArgumentList $target;
          }
          else
          {
              # for normal user the initalized credential cals is used
              invoke-command -computername "localhost" -Credential $cred -ScriptBlock $script -ArgumentList $target
          }
      }
      catch
      {
          Write-Error "Error executing resync command on host $target."# -foregroundcolor "red"
          throw
      }   
  }
  </code></pre>