Azure DevOps Server 2019：PowerShell@2用Start-Process -Credential无执行

在本地部署的Azure DevOps Server 2019 YAML构建管道中，需以运行Azure代理的用户以外的身份执行mycmd.exe。使用PowerShell@2任务，通过Start-Process的-Credential参数实现时，进程未执行任何任务就退出，重定向的stdOut.txt和stdErrorOut.txt均为空。尝试用Wait-Process替代-Wait参数无效，且无权限通过计划任务形式运行进程。

原尝试代码：

$runasUser = "user1@mydomain.com"
  
$password = "mypassWord"

$runasPassword = "$password"  | ConvertTo-SecureString -AsPlainText -Force

$runAsCredential = New-Object System.Management.Automation.PSCredential ( $runasUser, $runasPassword )

Start-Process mycmd.exe -ArgumentList $params -Credential $runAsCredential -WorkingDirectory "$binaryPath" -NoNewWindow -Wait -RedirectStandardOutput "$binaryPath\stdOut.txt" -RedirectStandardError "$binaryPath\stdErrorOut.txt"

修改后的尝试代码：

Start-Process mycmd.exe -ArgumentList $params -Credential $runAsCredential -WorkingDirectory "$binaryPath" -NoNewWindow -PassThru -RedirectStandardOutput "$binaryPath\stdOut.txt" -RedirectStandardError "$binaryPath\stdErrorOut.txt" | Wait-Process

1. 先排查基础权限与程序兼容性 #

• 确认user1@mydomain.com对$binaryPath目录拥有读写权限，包括创建输出日志文件的权限。
• 在代理服务器上，用该用户身份手动启动mycmd.exe，验证程序本身能正常运行，排除依赖缺失或程序内部错误。

2. 调整Start-Process调用逻辑 #

使用-Credential跨用户执行时，-NoNewWindow会导致会话上下文权限冲突，是进程异常退出的常见原因。建议移除该参数，同时确保路径使用绝对路径：

$runasUser = "user1@mydomain.com"
$password = "mypassWord" # 注意：生产环境请用Azure Pipelines安全变量存储密码，不要硬编码
$runasPassword = $password | ConvertTo-SecureString -AsPlainText -Force
$runAsCredential = New-Object System.Management.Automation.PSCredential ($runasUser, $runasPassword)

# 构建mycmd.exe的绝对路径
$myCmdFullPath = Join-Path -Path $binaryPath -ChildPath "mycmd.exe"

Start-Process -FilePath $myCmdFullPath -ArgumentList $params -Credential $runAsCredential `
  -WorkingDirectory $binaryPath -Wait `
  -RedirectStandardOutput (Join-Path $binaryPath "stdOut.txt") `
  -RedirectStandardError (Join-Path $binaryPath "stdErrorOut.txt")

3. 改用Invoke-Command本地远程执行 #

如果上述方法仍无效，可通过Invoke-Command模拟本地远程调用，绕过Start-Process的跨用户上下文限制：

$runasUser = "user1@mydomain.com"
$password = "mypassWord"
$runasPassword = $password | ConvertTo-SecureString -AsPlainText -Force
$runAsCredential = New-Object System.Management.Automation.PSCredential ($runasUser, $runasPassword)

Invoke-Command -ComputerName localhost -Credential $runAsCredential -ScriptBlock {
  # 引用外部变量
  $targetPath = $using:binaryPath
  $cmdParams = $using:params
  
  # 执行命令并合并输出
  & "$targetPath\mycmd.exe" $cmdParams 2>&1 | Out-File "$targetPath\combinedOutput.txt"
}

4. 添加调试日志定位问题 #

• 验证用户对目标目录的权限：

Test-Path -Path $binaryPath -Credential $runAsCredential -PathType Container

• 捕获进程退出代码，确认程序是否正常启动：

$process = Start-Process -FilePath $myCmdFullPath -ArgumentList $params -Credential $runAsCredential `
  -WorkingDirectory $binaryPath -PassThru
$process.WaitForExit()
Write-Host "进程退出代码: $($process.ExitCode)"

内容的提问来源于stack exchange，提问作者Sibi JV