PowerShell是否有类似runas /netonly的等效参数？跨域AD登录遇问题

Start-Process本身没有对应runas /netonly的参数，直接用-Credential会尝试用目标域账户登录本地机器，导致工作站信任关系错误。以下是两种可行的解决方案：

方法一：直接调用runas命令 #

既然原runas /netonly命令有效，可直接在PowerShell中封装执行该命令，适合快速实现：

# 假设$Account、$Password、$TargetDomain是从GUI获取的输入变量
$runasCmd = "runas /netonly /user:$TargetDomain\$Account `"mmc dsa.msc /domain=$TargetDomain`""
Start-Process cmd.exe -ArgumentList "/c $runasCmd"

如果要避免手动输入密码，可结合SendKeys自动填充密码框（注意：SendKeys稳定性依赖运行环境）：

Add-Type -AssemblyName System.Windows.Forms
$runasProcess = Start-Process cmd.exe -ArgumentList "/c $runasCmd" -PassThru -WindowStyle Hidden
Start-Sleep -Seconds 1
[System.Windows.Forms.SendKeys]::SendWait("$Password{ENTER}")

方法二：调用Windows API实现/netonly效果 #

通过P/Invoke调用CreateProcessWithLogonWAPI，指定LOGON_NETCREDENTIALS_ONLY标志，完全模拟runas /netonly的行为，稳定性更高：

Add-Type @"
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;

public class RunAsNetOnly {
    [StructLayout(LayoutKind.Sequential)]
    public struct STARTUPINFO {
        public int cb;
        public string lpReserved;
        public string lpDesktop;
        public string lpTitle;
        public int dwX;
        public int dwY;
        public int dwXSize;
        public int dwYSize;
        public int dwXCountChars;
        public int dwYCountChars;
        public int dwFillAttribute;
        public int dwFlags;
        public short wShowWindow;
        public short cbReserved2;
        public IntPtr lpReserved2;
        public IntPtr hStdInput;
        public IntPtr hStdOutput;
        public IntPtr hStdError;
    }

    [StructLayout(LayoutKind.Sequential)]
    public struct PROCESS_INFORMATION {
        public IntPtr hProcess;
        public IntPtr hThread;
        public int dwProcessId;
        public int dwThreadId;
    }

    [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
    public static extern bool CreateProcessWithLogonW(
        string lpszUsername,
        string lpszDomain,
        string lpszPassword,
        int dwLogonFlags,
        string lpApplicationName,
        string lpCommandLine,
        int dwCreationFlags,
        IntPtr lpEnvironment,
        string lpCurrentDirectory,
        ref STARTUPINFO lpStartupInfo,
        out PROCESS_INFORMATION lpProcessInformation);

    public const int LOGON_NETCREDENTIALS_ONLY = 0x00000002;
    public const int CREATE_DEFAULT_ERROR_MODE = 0x04000000;
}
"@

# 替换为实际参数（可从GUI控件获取）
$targetUsername = "目标域账户名"
$targetDomain = "目标域名"
$targetPassword = "账户密码"
$appPath = "mmc.exe"
$appArgs = "dsa.msc /domain=$targetDomain"

$startupInfo = New-Object RunAsNetOnly+STARTUPINFO
$startupInfo.cb = [System.Runtime.InteropServices.Marshal]::SizeOf($startupInfo)
$processInfo = New-Object RunAsNetOnly+PROCESS_INFORMATION

$isSuccess = [RunAsNetOnly]::CreateProcessWithLogonW(
    $targetUsername,
    $targetDomain,
    $targetPassword,
    [RunAsNetOnly]::LOGON_NETCREDENTIALS_ONLY,
    $appPath,
    $appArgs,
    [RunAsNetOnly]::CREATE_DEFAULT_ERROR_MODE,
    [IntPtr]::Zero,
    $PWD.Path,
    [ref]$startupInfo,
    [ref]$processInfo
)

if (-not $isSuccess) {
    $errorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error()
    Write-Error "进程启动失败，错误代码: $errorCode"
} else {
    # 释放系统句柄
    [System.Diagnostics.Process]::GetProcessById($processInfo.dwProcessId) | Out-Null
    [System.Runtime.InteropServices.Marshal]::CloseHandle($processInfo.hProcess)
    [System.Runtime.InteropServices.Marshal]::CloseHandle($processInfo.hThread)
}

原理说明 #

LOGON_NETCREDENTIALS_ONLY标志会让进程以当前本地用户身份运行，但访问网络资源时使用指定的域账户凭证，完全规避了本地机器与目标域的信任关系限制，和runas /netonly的逻辑一致。

内容的提问来源于stack exchange，提问作者Eldrin