Running PowerShell scripts as domain accounts through Clustered Scheduled Tasks

Hey all,

I am trying to use Clustered Scheduled Tasks to replace a number of automation tasks and I am hitting a very frustrating issue. Because clustered scheduled tasks can only run as System I have a loader script which can grab the credentials required and then run a script.

This is the code;

$XMLFile = $PSScriptRoot + "\1d.xml"

$Cert = Get-ChildItem "Cert:\LocalMachine\My" | ? {$_.Subject -eq "CN=PowerShellAuto"} 

$Scripts = Import-Clixml -Path $XMLFile

if ([bool]$Scripts)
{
    Foreach ($s in $Scripts)
    {
        $saObj = Import-Clixml -Path $s.ServiceAccount
        $EncryptedBytes = [System.Convert]::FromBase64String($saObj.Password)
        $DecryptedBytes = $Cert.PrivateKey.Decrypt($EncryptedBytes,$true)
        $Creds = New-Object System.Management.Automation.PSCredential -ArgumentList ($saObj.Domain + '\' + $saObj.User),([system.text.encoding]::UTF8.GetString($DecryptedBytes) | ConvertTo-SecureString -AsPlainText -Force)
        try {
            Start-Process 'PowerShell.exe' -Credential $Creds -ArgumentList "-file `"$($S.ScriptFile)`" -ExecutionPolicy Bypass" -ErrorAction Stop} catch {$_}
    }
}

Now this works perfectly if I run it as my domain admin account but I can't get the scheduled task to do anything. I can verify that everything is working as expected other than the Start-Process command which is failing. If I use psexec to runas local system then I can get the following error;

Start-Process : This command cannot be run due to the error: Access is denied.
At C:\Program Files\WindowsPowerShell\Scripts\1d.ps1:17 char:13
+             Start-Process 'PowerShell.exe' -Credential $Creds -Argume ...
+             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Start-Process], InvalidOp 
   erationException
    + FullyQualifiedErrorId : InvalidOperationException,Microsoft.PowerShell.C 
   ommands.StartProcessCommand

However when I run the scheduled task I do not get any errors (I am posting them to a log file in both cases), it runs and logs other actions but there is no error on this line. The script which it is supposed to be running just writes a line of text to a txt file and that never happens unless I run the loader script as a domain account. 

Disregarding the clustered part does anyone have any experience in getting scheduled tasks (or services or something) that run as system to successfully execute a powershell script as a domain account? If so can you please post the code?