You can create a 'callable hook' on the remote machine: It's a scheduled task set to "run only when user is logged on," assigned to run under the account of the user who will be logged in upon execution. The action of the task is the executable you want to run.
Scheduled tasks can be created remotely via powershell or schtasks, and subsequently called simply by the 'name' of the task itself using schtasks or powershell's Start-ScheduledTask.
- On the remote machine, create a barebones scheduled task that is run by the user who is running the current session.
- Set the task to run "only when user is logged on"
- If the .exe or item in the "Action" tab of the scheduled task has "Run as Administrator" set on the filesystem item (right-click, properties, Compatibility>Run as Administrator), the scheduled task needs to be run with elevated privileges as well or it will fail or not appear.
- The author of the scheduled task should have admin privileges, so that when it is called remotely you can use this admin account for calling a scheduled task which then gets executed on the user profile specified under "run only when user is logged on."
- Make sure the machine is logged on as that user.
- It may be application-dependent if this task will properly execute if the machine is locked. In my experience it does.
- From here, you can use schtasks.exe and call the Name of the scheduled task along with the hostname, and pass along the credentials of the elevated account used to author the scheduled task (not the user who will be logged on).
- You can alternatively call it in powershell if the remote machine is running a powershell version that supports Start-ScheduledTask.
To call the task you reference the task by the Name you gave it:
schtasks /run /TN "mytaskname" /s "host" /u "user" /p "password"
Creating a scheduled task remotely is possible with either schtasks.exe or New-ScheduledTaskPrincipal in powershell. If the executable or "Action" item in the task is flagged as 'run as administrator' on the filesystem, the task will require a New-ScheduledTaskPrincipal credential to be attached during the task creation in order to set that property appropriately.
The currently-logged-in user can be a moving target, although it can be queried with Get-LoggedOnUser via powershell prior to the scheduled task creation itself.
Verbose code for such is forthcoming in the next 48 hours, I wanted to make the basic structure available for you all.