无域同子网下，如何用PowerShell远程登录管理员执行服务查询脚本

问题背景 #

本地主机MYPC与多台目标PC处于同一子网，无域环境，每台目标PC均拥有本地管理员账户。原PowerShell脚本因未提前完成远程身份认证运行报错，手动建立IPC$连接或执行NET USE命令后脚本可正常运行，现需直接在PowerShell内完成管理员远程认证并执行命令，无需手动操作或依赖DOS脚本。

原脚本示例：

$ComputerName = "PC1","PC2","PC3","PC4","PC5"
$ServiceName = "Service1","Service2","Service3","Service4"

foreach ($Computer in $ComputerName)
    {
      foreach ($Service in $ServiceName)
      {
        # 获取当前服务启动类型（自动/手动）
        $CurrentType = Get-Service -Name $Service -ComputerName $Computer | Where{$_.StartType -eq "Manual"}
        # 后续业务逻辑...
      }
    }

解决方案 #

方法1：使用PSCredential对象结合Get-Service #

直接创建凭据对象，在Get-Service命令中指定凭据，无需提前建立IPC连接：

# 定义目标主机和服务列表
$ComputerName = "PC1","PC2","PC3","PC4","PC5"
$ServiceName = "Service1","Service2","Service3","Service4"

# 弹出交互式输入框获取目标PC本地管理员凭据（避免明文密码风险）
$cred = Get-Credential -Message "输入目标PC的本地管理员账户信息"

foreach ($Computer in $ComputerName) {
    foreach ($Service in $ServiceName) {
        try {
            # 指定凭据远程获取服务信息
            $service = Get-Service -Name $Service -ComputerName $Computer -Credential $cred -ErrorAction Stop
            $CurrentType = $service | Where-Object {$_.StartType -eq "Manual"}
            # 输出结果示例
            Write-Host "主机[$Computer]的服务[$Service]启动类型：$($service.StartType)"
        }
        catch {
            Write-Warning "获取主机[$Computer]的服务[$Service]信息失败：$($_.Exception.Message)"
        }
    }
}

方法2：使用Invoke-Command批量执行远程脚本块 #

针对多主机批量操作，可通过远程会话一次性执行逻辑，效率更高：

$ComputerName = "PC1","PC2","PC3","PC4","PC5"
$ServiceName = "Service1","Service2","Service3","Service4"
$cred = Get-Credential -Message "输入目标PC的本地管理员账户信息"

# 批量远程执行服务查询逻辑
Invoke-Command -ComputerName $ComputerName -Credential $cred -ScriptBlock {
    param($services)
    foreach ($service in $services) {
        $svc = Get-Service -Name $service -ErrorAction SilentlyContinue
        # 返回结构化结果
        [PSCustomObject]@{
            ComputerName = $env:COMPUTERNAME
            ServiceName = $service
            StartType = if($svc){$svc.StartType}else{"未找到服务"}
            Status = if($svc){$svc.Status}else{"未找到服务"}
        }
    }
} -ArgumentList (,$ServiceName) | Format-Table -AutoSize

方法3：在PowerShell中创建IPC$映射（替代NET USE） #

若需建立持久化IPC连接，可直接使用PowerShell的New-SmbMapping命令：

$ComputerName = "PC1","PC2","PC3","PC4","PC5"
$cred = Get-Credential -Message "输入目标PC的本地管理员账户信息"

foreach ($Computer in $ComputerName) {
    try {
        # 创建持久化IPC$映射
        New-SmbMapping -LocalPath "\\$Computer\IPC$" -RemotePath "\\$Computer\IPC$" -Credential $cred -Persistent $true -ErrorAction Stop
        Write-Host "已成功建立与[$Computer]的IPC$连接"
    }
    catch {
        Write-Warning "建立与[$Computer]的IPC$连接失败：$($_.Exception.Message)"
    }
}

# 连接建立后，可直接执行原有的Get-Service逻辑

注意事项 #

• 确保目标PC已启用WinRM服务，可在目标PC执行winrm quickconfig开启，或通过已认证的远程会话远程执行该命令
• Get-Service的-Credential参数要求PowerShell版本至少为5.1
• 禁止在脚本中硬编码明文密码，优先使用Get-Credential交互式输入凭据，避免安全风险

内容的提问来源于stack exchange，提问作者hanrp