Q:

Elevating privilages to run a powershell script to create a directory and set ACL

I've been looking at creating Home Drives for our users. We've recently had a request from senior management to lock down access to these folders to just a sysadmin group and the individual folder for each user.
We delegate the creation of these folders to our helpdesk, but dont want them to have access to the folders after creation.
I've written a PowerShell script, that creates the folder and sets the ACL based on some user input but i cant figure out a way to get it to run correctly for a user who has limited rights over the directory. If i run this with my account, it does exactly as i need it to.
Set-Variable name -value (Read-Host -Prompt "Please Enter the username")

Set-Variable location -Value (Read-Host -Prompt "Please Enter the location of the user")
        if ($location -eq "loc1") {Set-Variable homepath "\\server1\folder"}
        elseif ($location -eq "loc2") {Set-Variable homepath "\\server2\folder"}
        elseif ($location -eq "loc3") {Set-Variable homepath "\\server3\folder"}
        elseif ($location -eq "loc4") {Set-Variable homepath "\\server4\folder"}
        elseif ($location -eq "loc5") {Set-Variable homepath "\\server5\folder"}

    #Fills variable used to set ACL on the folder.
    Set-Variable domainuser -value "Domain\$name"

$newfolder = new-item -ItemType Directory -path $homepath -Name $name
$Rights = [System.Security.AccessControl.FileSystemRights]"FullControl,Modify,ReadAndExecute,ListDirectory,Read,Write"
$InheritanceFlag = @([System.Security.AccessControl.InheritanceFlags]::ContainerInherit,[System.Security.AccessControl.InheritanceFlags]::ObjectInherit)
$PropagationFlag = [System.Security.AccessControl.PropagationFlags]::None
$objType =[System.Security.AccessControl.AccessControlType]::Allow
$objUser = New-Object System.Security.Principal.NTAccount "$domainuser"
$objACE = New-Object System.Security.AccessControl.FileSystemAccessRule `
      ($objUser, $Rights, $InheritanceFlag, $PropagationFlag, $objType)
$ACL = Get-Acl -Path $NewFolder
$ACL.AddAccessRule($objACE)
    Set-ACL -Path $NewFolder.FullName -AclObject $ACL

I know this is less of a scripting question/problem and more an environment/execution type thing, but i'm open to any suggestion on how best to achieve what I need. I wouldn't be opposed to storing a service accounts credentials if that was what was needed, but i've tried this and had limited success.
As always, any help is appreciated!

A:

Not sure if this would work for your environment and SLAs but one solution could be to separate the input from actual processing, so you end up writing 2 scripts. E.g.
1-) Send-HomeFolderCreationData
2-) Receive-HomeFolderCreationData 
1st script can be run by any of the techs. It will gather the info from them and submit it to a location that they will have write access to. It should probably have logging about the job as well ($env:UserName, $env:ComputerName, Time Of Event etc.)
Then, 2nd script will pick up the data and do the actual work. That second one will be a scheduled job that runs as frequently as your SLA requires, and the service account that runs it should have priviledges to create the folder.
As far as I know, PowerShell does NOT allow the kind of escalation you are looking for, so this is one way I found to be working well around this.

