gemini : 因為這個系統上已停用指令碼執行，所以無法載入 C:\Users\max32\AppData\Roaming\npm\gemini.ps1 檔案。如需詳細資訊，請參閱 about_Execution_Policies，網址為 https:/go.microsoft.com/fwlink/?LinkID=135170。

位於 線路:1 字元:1

• gemini
  • CategoryInfo : SecurityError: (:) [], PSSecurityException
  • FullyQualifiedErrorId : UnauthorizedAccess

PowerShell 安全設定（Execution Policy）阻止了 gemini.ps1 這個腳本的執行。這是 Windows 為了防止惡意腳本執行而採取的預設安全措施。

更改執行原則

您可以將原則更改為 RemoteSigned。這是最常用的設定，它允許您自己建立的腳本執行，但要求從網路上或電子郵件下載的腳本必須有可靠的數位簽章。

在管理員 PowerShell 視窗中，執行以下指令：

PowerShell

Set-ExecutionPolicy RemoteSigned -Scope CurrentUser

• RemoteSigned: 這是推薦的安全級別。
• -Scope CurrentUser: 這只會更改您當前使用者的設定，不會影響系統上的其他使用者（更安全）。

額外說明： 如果您希望將執行原則改回最嚴格的狀態（不允許任何腳本執行），可以使用以下指令：

PowerShell

Set-ExecutionPolicy Restricted -Scope CurrentUser

<identity impersonate=”true” />

再設定 Enable Run As User to Act as the Operating System
https://stackoverflow.max-everyday.com/2018/02/enable-run-as-user-to-act-as-the-operating-system/

再開啟相關的權限給 Run As User 帳號。

主程式範例：
https://support.microsoft.com/en-us/help/306158/how-to-implement-impersonation-in-an-asp-net-application

<%@ Page Language="C#"%>
<%@ Import Namespace = "System.Web" %>
<%@ Import Namespace = "System.Web.Security" %>
<%@ Import Namespace = "System.Security.Principal" %>
<%@ Import Namespace = "System.Runtime.InteropServices" %>

<script runat=server>
public const int LOGON32_LOGON_INTERACTIVE = 2;
public const int LOGON32_PROVIDER_DEFAULT = 0;

WindowsImpersonationContext impersonationContext; 

[DllImport("advapi32.dll")]
public static extern int LogonUserA(String lpszUserName, 
String lpszDomain,
String lpszPassword,
int dwLogonType, 
int dwLogonProvider,
ref IntPtr phToken);
[DllImport("advapi32.dll", CharSet=CharSet.Auto, SetLastError=true)]
public static extern int DuplicateToken(IntPtr hToken, 
int impersonationLevel,  
ref IntPtr hNewToken);
                          
[DllImport("advapi32.dll", CharSet=CharSet.Auto, SetLastError=true)]
public static extern bool RevertToSelf();

[DllImport("kernel32.dll", CharSet=CharSet.Auto)]
public static extern  bool CloseHandle(IntPtr handle);

public void Page_Load(Object s, EventArgs e)
{
if(impersonateValidUser("username", "domain", "password"))
{
//Insert your code that runs under the security context of a specific user here.
undoImpersonation();
}
else
{
//Your impersonation failed. Therefore, include a fail-safe mechanism here.
}
}

private bool impersonateValidUser(String userName, String domain, String password)
{
WindowsIdentity tempWindowsIdentity;
IntPtr token = IntPtr.Zero;
IntPtr tokenDuplicate = IntPtr.Zero;

if(RevertToSelf())
{
if(LogonUserA(userName, domain, password, LOGON32_LOGON_INTERACTIVE, 
LOGON32_PROVIDER_DEFAULT, ref token) != 0)
{
if(DuplicateToken(token, 2, ref tokenDuplicate) != 0) 
{
tempWindowsIdentity = new WindowsIdentity(tokenDuplicate);
impersonationContext = tempWindowsIdentity.Impersonate();
if (impersonationContext != null)
{
CloseHandle(token);
CloseHandle(tokenDuplicate);
return true;
}
}
} 
}
if(token!= IntPtr.Zero)
CloseHandle(token);
if(tokenDuplicate!=IntPtr.Zero)
CloseHandle(tokenDuplicate);
return false;
}

private void undoImpersonation()
{
impersonationContext.Undo();
}
</script>

1. On the computer that is running Tableau Server, select Start > Control Panel > Administrative Tools > Local Security Policy.
2. In the Local Security Settings window, expand Local Policies, click User Rights Assignments, and then right-click Act as part of the operating system and select Properties.

   

3. In the Act as part of the operating system Properties window, click Add User or Group.
4. Type the <domain>\<username> for the Tableau Server Run As User account (for example: MYCOMPANY\tableau_server), and then click Check Names.
5. When the account resolves correctly, it is underlined. Click OK.
6. Click OK to close the Local Security Policy windows.

照上面的流程，可以讓 asp.net 提升權限為其他帳號，預設完全沒去修改的情況下，帳號是使用：

IIS APPPOOL\DefaultAppPool

建立本機使用者帳戶

更新日期: 2012年3月

適用於: Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012

using System;
using System.IO;

class Program
{
    static void Main()
    {
        // Copying a file that doesn't exist:
        try
        {
            File.Copy("file-missing.txt", "file-new.txt");
        }
        catch (Exception ex)
        {
            Console.WriteLine(ex);
            // System.IO.FileNotFoundException: Could not find file 'file-missing.txt'.
        }

        // Copying to a file without overwrite
        try
        {
            File.Copy("file-a.txt", "file-b.txt");
        }
        catch (Exception ex)
        {
            Console.WriteLine(ex);
            // System.IO.IOException: The file 'file-b.txt' already exists.
        }
    }
}

https://support.microsoft.com/en-us/help/306158/how-to-implement-impersonation-in-an-asp-net-application

MS 寫的不太貼心：

Impersonate the IIS Authenticated Account or User

To impersonate the Microsoft Internet Information Services (IIS) authenticating user on every request for every page in an ASP.NET application, you must include an <identity> tag in the Web.config file of this application and set the impersonate attribute to true. For example:

<identity impersonate="true" />

back to the top

Impersonate a Specific User for All the Requests of an ASP.NET Application

To impersonate a specific user for all the requests on all pages of an ASP.NET application, you can specify the userName and password attributes in the <identity> tag of the Web.config file for that application. For example:

<identity impersonate="true" userName="accountname" password="password" />

Note The identity of the process that impersonates a specific user on a thread must have the “Act as part of the operating system” privilege. By default, the Aspnet_wp.exe process runs under a computer account named ASPNET. However, this account does not have the required privileges to impersonate a specific user. You receive an error message if you try to impersonate a specific user. This information applies only to the .NET Framework 1.0. This privilege is not required for the .NET Framework 1.1.

To work around this problem, use one of the following methods:

• Grant the “Act as part of the operating system” privilege to the ASPNET account (the least privileged account).Note Although you can use this method to work around the problem, Microsoft does not recommend this method.
• Change the account that the Aspnet_wp.exe process runs under to the System account in the <processModel> configuration section of the Machine.config file.

正確用法：

The identity section goes under the system.web section:

<system.web>
  <authentication mode="Windows"/>
  <identity impersonate="true" userName="foo" password="bar"/>
</system.web>

相關文章：

Enable Run As User to Act as the Operating System
https://stackoverflow.max-everyday.com/2018/02/enable-run-as-user-to-act-as-the-operating-system/

附註：在impersonate為其他帳號時，需要開啟 asp.net 的 temp folder 的寫入權限給該 user account, 不然會產生錯誤訊息。

附註： 如果遇到這一個 Exception 在 copy file 時：

System.IO.IOException: The user name or password is incorrect.

at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.IO.File.InternalCopy(String sourceFileName, String destFileName, Boolean overwrite, Boolean checkHost)

請檢查 impersonate 相關的帳號/密碼設定，或寫法是否正確。

The type or namespace name ‘DllImport’ could not be found

範例程式：

using System;
using System.Collections.Generic;
using System.Linq;
using System.Runtime.InteropServices;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using MapsApp.DB;

namespace MapsApp
{
    public partial class _Default : System.Web.UI.Page
    {
        [DllImport("GeoUrbanApp.exe")]
        public static extern double CalcFigure(double east, double north, double size);
...

說明：

1：一定要 using System.Runtime.InteropServices;

2:  [DllImport(“GeoUrbanApp.exe”)] 的放置位置要在 class 裡，而不是 namespace 的第1層。

我服用中的版本：

 <ul>
 <%
 System.IO.DirectoryInfo diFiles = new System.IO.DirectoryInfo(Server.MapPath("/ImgUpload/"));
 foreach (var f in diFiles.GetFiles())
 {
 Response.Write("<li><img src='/ImgUpload/" + f.Name + "' width='200'/></li>");
 }
 %>
 </ul>

下指令：

Run the C# compiler like this:

  c:\windows\Microsoft.NET\Framework\v3.5\bin\csc.exe 
            /t:exe /out:MyApplication.exe MyApplication.cs  ...

路徑可能會變，也許是  v4.0 或 v4.5

如果是要 build asp.net c# 為dll 要改成 /target:library /out:bin\your-name-space.dll your-cs …

相關文章：

使用 csc.exe 建置命令列
https://docs.microsoft.com/zh-tw/dotnet/csharp/language-reference/compiler-options/command-line-building-with-csc-exe

HOW TO：裝載和執行基本 Windows Communication Foundation 服務
https://docs.microsoft.com/zh-tw/dotnet/framework/wcf/how-to-host-and-run-a-basic-wcf-service

Compiling and Running Code Examples
https://technet.microsoft.com/en-us/library/ms160695(v=sql.90).aspx

HOW TO：在 IIS 中裝載 WCF 服務
https://docs.microsoft.com/zh-tw/dotnet/framework/wcf/feature-details/how-to-host-a-wcf-service-in-iis

HOW TO：在 Managed 應用程式中裝載 WCF 服務
https://docs.microsoft.com/zh-tw/dotnet/framework/wcf/how-to-host-a-wcf-service-in-a-managed-application

How to: Host and Run a Basic Windows Communication Foundation Service
https://docs.microsoft.com/en-us/dotnet/framework/wcf/how-to-host-and-run-a-basic-wcf-service

寫入：

Response.Cookies["userInfo"]["userName"] = "patrick";
Response.Cookies["userInfo"]["lastVisit"] = DateTime.Now.ToString();
Response.Cookies["userInfo"].Expires = DateTime.Now.AddDays(1);

或：

HttpCookie aCookie = new HttpCookie("userInfo");
aCookie.Values["userName"] = "patrick";
aCookie.Values["lastVisit"] = DateTime.Now.ToString();
aCookie.Expires = DateTime.Now.AddDays(1);
Response.Cookies.Add(aCookie);

讀取：

if(Request.Cookies["userName"] != null)
    Label1.Text = Server.HtmlEncode(Request.Cookies["userName"].Value);

標準用的外框架：

Page Layout

The page layout provides the interface of the page. It contains the server controls, text, inline JavaScript, and HTML tags.

The following code snippet provides a sample ASP.NET page explaining Page directives, code section and page layout written in C#:

<!-- directives -->
<% @Page Language="C#" %>

<!-- code section -->
<script runat="server">

   private void convertoupper(object sender, EventArgs e)
   {
      string str = mytext.Value;
      changed_text.InnerHtml = str.ToUpper();
   }
</script>

<!-- Layout -->
<html>
   <head> 
      <title> Change to Upper Case </title> 
   </head>
   
   <body>
      <h3> Conversion to Upper Case </h3>
      
      <form runat="server">
         <input runat="server" id="mytext" type="text" />
         <input runat="server" id="button1" type="submit" value="Enter..." OnServerClick="convertoupper"/>
         
         <hr />
         <h3> Results: </h3>
         <span runat="server" id="changed_text" />
      </form>
      
   </body>
   
</html>

[IService1]

[ServiceContract(SessionMode = SessionMode.NotAllowed)]
public interface IService1
{
    [WebGet(UriTemplate = "date/{year}/{month}/{day}", ResponseFormat = WebMessageFormat.Xml)]
    [OperationContract]
    string GetDate(string day, string month, string year);

    [WebGet(UriTemplate = "greet", ResponseFormat = WebMessageFormat.Json)]
    [OperationContract]
    string Greeting();

    [WebInvoke(Method = "POST", UriTemplate = "submit", BodyStyle = WebMessageBodyStyle.WrappedRequest, ResponseFormat = WebMessageFormat.Json, RequestFormat = WebMessageFormat.Json)]
    [OperationContract]
    string Save(string data);

}

[Service1]

public class Service1: IService1
{
    public string GetDate(string day, string month, string year)
    {
        return new DateTime(Convert.ToInt32(year), Convert.ToInt32(month), Convert.ToInt32(day)).ToString("dddd, MMMM dd, yyyy");
    }
   public string Greeting()
    {
        return "Hello World";
    }
   public string Save(string data)
   {
       return data + "Has been saved!";
   }
}

Let’s send request to first method:

[WebGet(UriTemplate = "date/{year}/{month}/{day}", ResponseFormat = WebMessageFormat.Xml)]
    [OperationContract]
    string GetDate(string day, string month, string year);

Then go to command prompt and type following code
curl http://localhost:12576/Service1.svc/date/2012/1/12

Let’s send request to second method from curl:

[WebGet(UriTemplate = "greet", ResponseFormat = WebMessageFormat.Json)]
    [OperationContract]
    string Greeting();

Then go to command prompt and type following code:
curl http://localhost:12576/Service1.svc/greet

Now,let’s send a post request to third method from command prompt:

[WebInvoke(Method = "POST", UriTemplate = "submit", BodyStyle = WebMessageBodyStyle.WrappedRequest, ResponseFormat = WebMessageFormat.Json, RequestFormat = WebMessageFormat.Json)]

    [OperationContract]

    string Save(string data);

curl  -H “Content-Type: application/json” -H “Accept: application/json” -X POST -d ‘{“data”:”dummy data”}’ http://localhost:12576/Service1.svc/submit