PowerShell/PowerShell · critical · InvalidOperationException

Access is denied. You need to run this cmdlet from an elevat

Error message

Access is denied. You need to run this cmdlet from an elevated process.

What it means

Thrown by WSManHelper.ThrowIfNotAdministrator when the current Windows process does not have administrator privileges. WS-Management cmdlets modify system-level WinRM, CredSSP, and session configuration, all of which require elevation. The check uses WindowsPrincipal.IsInRole(WindowsBuiltInRole.Administrator).

Source

Thrown at src/Microsoft.WSMan.Management/WsManHelper.cs:155

        internal WSManHelper(PSCmdlet cmdlet)
        {
            cmdletname = cmdlet;
        }

        internal WSManHelper(NavigationCmdletProvider provider)
        {
            _provider = provider;
        }

        internal static void ThrowIfNotAdministrator()
        {
            System.Security.Principal.WindowsIdentity currentIdentity = System.Security.Principal.WindowsIdentity.GetCurrent();
            System.Security.Principal.WindowsPrincipal principal = new System.Security.Principal.WindowsPrincipal(currentIdentity);
            if (!principal.IsInRole(System.Security.Principal.WindowsBuiltInRole.Administrator))
            {
                string message = _resourceMgr.GetString("ErrorElevationNeeded");
                throw new InvalidOperationException(message);
            }
        }

        internal string GetResourceMsgFromResourcetext(string rscname)
        {
            return _resourceMgr.GetString(rscname);
        }

        internal static string FormatResourceMsgFromResourcetextS(string rscname,
            params object[] args)
        {
            return FormatResourceMsgFromResourcetextS(_resourceMgr, rscname, args);
        }

        internal string FormatResourceMsgFromResourcetext(string resourceName,
            params object[] args)
        {
            return FormatResourceMsgFromResourcetextS(_resourceMgr, resourceName, args);

View on GitHub (pinned to 3ff3c711bf)

Solutions

1. Launch PowerShell as Administrator (Right-click → Run as Administrator, or Start-Process powershell -Verb RunAs).
2. Run the cmdlet from a process that is already elevated (e.g., a scheduled task running as SYSTEM).
3. Ensure the executing account is a member of the local Administrators group and UAC is not blocking elevation.

Example fix

# before (non-elevated session)
Enable-WSManCredSSP -Role Client -DelegateComputer "*.contoso.com"
# → throws InvalidOperationException: Access is denied.

# after
Start-Process powershell -Verb RunAs -ArgumentList '-Command', 'Enable-WSManCredSSP -Role Client -DelegateComputer "*.contoso.com"'

// Check for admin privileges before calling WSMan APIs
var identity = System.Security.Principal.WindowsIdentity.GetCurrent();
var principal = new System.Security.Principal.WindowsPrincipal(identity);
if (!principal.IsInRole(System.Security.Principal.WindowsBuiltInRole.Administrator))
{
    throw new UnauthorizedAccessException("Run PowerShell as Administrator to use WS-Management cmdlets.");
}
WSManHelper.ThrowIfNotAdministrator(); // now safe to proceed

// PowerShell:
# $principal = [Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
# if (-not $principal.IsInRole([Security.Principal.WindowsBuiltIn]::Administrator)) { Start-Process pwsh -Verb RunAs; exit }

static bool IsRunningAsAdministrator() { var p = new WindowsPrincipal(WindowsIdentity.GetCurrent()); return p.IsInRole(WindowsBuiltInRole.Administrator); }

try { Enable-WSManCredSSP -Role Client -DelegateComputer '*.contoso.com' }
catch [System.InvalidOperationException] {
    if ($_.Exception.Message -match 'elevated') { Write-Error 'Re-launch PowerShell as Administrator and retry.'; break }
    throw
}

When it happens

Trigger: Running any WSMan cmdlet (Enable-WSManCredSSP, Set-WSManInstance, New-WSManInstance, etc.) from a non-elevated PowerShell session. ThrowIfNotAdministrator is called at the start of the cmdlet's BeginProcessing/EndProcessing.

Common situations: Launching PowerShell without 'Run as Administrator'; UAC suppressing elevation; running under a service account that is not in the local Administrators group.

Related errors

• The {0} parameter cannot be used when the {1} parameter valu
• Provider name must be specified.
• Could not retrieve information about the {0} provider. Error
• No provider found with name {0}.
• Event cannot be written because there are no events defined

AI-assisted analysis of PowerShell/PowerShell@3ff3c711bf (2026-08-13). Data as JSON: /api/errors/e1c8c122a8cbc734. Report an issue: GitHub.