title: Import-CliXML fails when called within a constrained session
body: <p><strong>My scenario:</strong></p>
  
  <ol>
  <li>I have a function that performs a privileged operation</li>
  <li>This function requires access to a secret key</li>
  <li>I need to run this function in a constraint PowerShell session (i.e. the function must run in a security context different from the user that invokes it)</li>
  </ol>
  
  <p><strong>Here is how I attempted to implement a solution:</strong></p>
  
  <ol>
  <li><p>I created a dedicated account that will provide RunAs credentials
      for a constrained PSSession.</p></li>
  <li><p>I logged-in interactively as the service account and ran this command:</p>
  
  <p>ConvertTo-SecureString "MySecretKey....." -AsPlainText -Force | 
     Export-Clixml C:\PSScripts\panosAccessToken</p></li>
  </ol>
  
  <p>This created a token encrypted for my service account.
   3. Inside the script that I am delegating, which will run in the context of the service account, I decrypt the key like so:</p>
  
  <pre><code>$accessToken = Import-Clixml C:\PSScripts\token
  </code></pre>
  
  <ol start="4">
  <li>Next I register a PSSession, see details below.</li>
  </ol>
  
  <p><strong>The Issue:</strong>
  When users connect to the session and attempt to run the function, the get the following error message:</p>
  
  <pre><code>[localhost]: PS&gt; Get-PANOSBlockedTraffic
  Import-Clixml : Cannot find drive. A drive with the name 'C' does not exist.
  At line:4 char:20
  +     $accessToken = Import-Clixml C:\PSScripts\token
  +                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      + CategoryInfo          : ObjectNotFound: (C:String) [Import-Clixml], DriveNotFoundException
      + FullyQualifiedErrorId : DriveNotFound,Microsoft.PowerShell.Commands.ImportClixmlCommand
  </code></pre>
  
  <p>It appears that my function is not allowed to access the file system, despite the fact that the service account has the appropriate rights.
  What am I missing?</p>
  
  <pre><code> $getBlockedTraffic = {   
          $accessToken = Import-Clixml C:\PSScripts\token
          # The rest of the logic is removed to save space
  
      }
  
  New-PSSessionConfigurationFile -Path c:\PSScripts\panos.pssc `
                                 -Description 'PANOS Delegation EndPoint' `
                                 -ExecutionPolicy Restricted `
                                 -SessionType RestrictedRemoteServer `
                                 -LanguageMode FullLanguage `
                                 -FunctionDefinitions @{Name="Get-PANOSBlockedTraffic";ScriptBlock=$getBlockedTraffic; Options="AllScope"}
  
  Unregister-pssessionconfiguration -name FirewallManagement -force
  Test-PSSessionConfigurationFile -Path c:\PSScripts\panos.pssc
  
  $secpasswd = ConvertTo-SecureString "pwdHere" -AsPlainText -Force
  $sessionCreds = New-Object System.Management.Automation.PSCredential ("domain\user", $secpasswd)
  
  Register-PSSessionConfiguration -Path 'c:\PSScripts\panos.pssc' `
                                  -Name FirewallManagement `
                                  -ShowSecurityDescriptorUI `
                                  -RunAsCredential $sessionCreds `
                                  -AccessMode Remote `
                                  -Force
  </code></pre>