{"record":{"id":"e1c8c122a8cbc734","repo":"PowerShell/PowerShell","slug":"access-is-denied-you-need-to-run-this-cmdlet-from","errorCode":null,"errorMessage":"Access is denied. You need to run this cmdlet from an elevated process.","messagePattern":"Access is denied\\. You need to run this cmdlet from an elevated process\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"critical","filePath":"src/Microsoft.WSMan.Management/WsManHelper.cs","lineNumber":155,"sourceCode":"\n        internal WSManHelper(PSCmdlet cmdlet)\n        {\n            cmdletname = cmdlet;\n        }\n\n        internal WSManHelper(NavigationCmdletProvider provider)\n        {\n            _provider = provider;\n        }\n\n        internal static void ThrowIfNotAdministrator()\n        {\n            System.Security.Principal.WindowsIdentity currentIdentity = System.Security.Principal.WindowsIdentity.GetCurrent();\n            System.Security.Principal.WindowsPrincipal principal = new System.Security.Principal.WindowsPrincipal(currentIdentity);\n            if (!principal.IsInRole(System.Security.Principal.WindowsBuiltInRole.Administrator))\n            {\n                string message = _resourceMgr.GetString(\"ErrorElevationNeeded\");\n                throw new InvalidOperationException(message);\n            }\n        }\n\n        internal string GetResourceMsgFromResourcetext(string rscname)\n        {\n            return _resourceMgr.GetString(rscname);\n        }\n\n        internal static string FormatResourceMsgFromResourcetextS(string rscname,\n            params object[] args)\n        {\n            return FormatResourceMsgFromResourcetextS(_resourceMgr, rscname, args);\n        }\n\n        internal string FormatResourceMsgFromResourcetext(string resourceName,\n            params object[] args)\n        {\n            return FormatResourceMsgFromResourcetextS(_resourceMgr, resourceName, args);","sourceCodeStart":137,"sourceCodeEnd":173,"githubUrl":"https://github.com/PowerShell/PowerShell/blob/3ff3c711bf54a18f8440f3c5190c3ac91cdc5852/src/Microsoft.WSMan.Management/WsManHelper.cs#L137-L173","documentation":"Thrown by WSManHelper.ThrowIfNotAdministrator when the current Windows process does not have administrator privileges. WS-Management cmdlets modify system-level WinRM, CredSSP, and session configuration, all of which require elevation. The check uses WindowsPrincipal.IsInRole(WindowsBuiltInRole.Administrator).","triggerScenarios":"Running any WSMan cmdlet (Enable-WSManCredSSP, Set-WSManInstance, New-WSManInstance, etc.) from a non-elevated PowerShell session. ThrowIfNotAdministrator is called at the start of the cmdlet's BeginProcessing/EndProcessing.","commonSituations":"Launching PowerShell without 'Run as Administrator'; UAC suppressing elevation; running under a service account that is not in the local Administrators group.","solutions":["Launch PowerShell as Administrator (Right-click → Run as Administrator, or Start-Process powershell -Verb RunAs).","Run the cmdlet from a process that is already elevated (e.g., a scheduled task running as SYSTEM).","Ensure the executing account is a member of the local Administrators group and UAC is not blocking elevation."],"exampleFix":"# before (non-elevated session)\nEnable-WSManCredSSP -Role Client -DelegateComputer \"*.contoso.com\"\n# → throws InvalidOperationException: Access is denied.\n\n# after\nStart-Process powershell -Verb RunAs -ArgumentList '-Command', 'Enable-WSManCredSSP -Role Client -DelegateComputer \"*.contoso.com\"'","handlingStrategy":"validation","validationCode":"// Check for admin privileges before calling WSMan APIs\nvar identity = System.Security.Principal.WindowsIdentity.GetCurrent();\nvar principal = new System.Security.Principal.WindowsPrincipal(identity);\nif (!principal.IsInRole(System.Security.Principal.WindowsBuiltInRole.Administrator))\n{\n    throw new UnauthorizedAccessException(\"Run PowerShell as Administrator to use WS-Management cmdlets.\");\n}\nWSManHelper.ThrowIfNotAdministrator(); // now safe to proceed\n\n// PowerShell:\n# $principal = [Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()\n# if (-not $principal.IsInRole([Security.Principal.WindowsBuiltIn]::Administrator)) { Start-Process pwsh -Verb RunAs; exit }","typeGuard":"static bool IsRunningAsAdministrator() { var p = new WindowsPrincipal(WindowsIdentity.GetCurrent()); return p.IsInRole(WindowsBuiltInRole.Administrator); }","tryCatchPattern":"try { Enable-WSManCredSSP -Role Client -DelegateComputer '*.contoso.com' }\ncatch [System.InvalidOperationException] {\n    if ($_.Exception.Message -match 'elevated') { Write-Error 'Re-launch PowerShell as Administrator and retry.'; break }\n    throw\n}","preventionTips":["Always launch PowerShell with 'Run as Administrator' before using WSMan cmdlets.","Add an elevation self-check at the top of scripts that use WSMan: relaunch elevated if not admin.","For scheduled tasks, configure the task to run with highest privileges."],"tags":["wsman","elevation","administrator","permissions","windows","uac"],"backgroundTag":null,"analyzedSha":"3ff3c711bf54a18f8440f3c5190c3ac91cdc5852","analyzedAt":"2026-08-13T10:39:10.759Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}