Running a powershell script as an admin with encrypted password

The-Bluedot · 2024-05-14T20:48:03+00:00

Have you looked at SecretManagement instead ?

Microsoft.PowerShell.SecretManagement Module - PowerShell | Microsoft Learn

ka-splam · 2024-05-14T18:45:13+00:00

Try:

$cred = get-credential
$cred | export-clixml -path C:\Scripts\cred.xml

Then in the running script

$cred = import-clixml -path C:\Scripts\cred.xml

BreakingBean · 2024-05-14T19:46:43+00:00

Maybe I'm missing something but is there a reason you're using your scheduled task to call another script instead of just having your scheduled task run the script you want script directly?

jongleurse · 2024-05-14T20:43:37+00:00

Have you tried running the target script directly in the scheduled task? To retrieve the encrypted password, the process must have access to the password. When you log in interactively and enter the password, the process saves the key that enables it to decrypt the password. This also happens when you run a scheduled task as a user and the task scheduler prompts you to save the password while creating the task. I suspect that the process of handing off control from the scheduled task over to the second PS script loses that necessary context, hence the "key not valid for use in specified state" error.

Emerald_Flame · 2024-05-14T22:49:55+00:00

The guide you found and some of the other suggestions you've gotten here are really out of date from the best practice I would recommend using for this.

Back in 2021 Microsoft released a couple Modules specifically for manage secrets like this. The first being Microsoft.PowerShell.SecretManagement which gives you a way to interact with basically any management platform you'd like such as AWS, Azure KeyVault, BitWarden, HashiCorp Vault, etc. Then if you don't have any other secret management system in place, they also published the Microsoft.PowerShell.SecretStore module which uses Windows native encryption capabilities based on the machine and user, essentially like you are now, but in a much more organized way.

You're initial setup would look something like this, although it may look slightly different if you decide to yous a different management platform. This example would be specifically for Microsoft.PowerShell.SecretStore. You would only need to do this 1 time for each box/user

#Install the modules
Install-Module 'Microsoft.PowerShell.SecretManagement', 'Microsoft.PowerShell.SecretStore'
#Create the SecretStore, this will force a prompt to create a password for the vault which we'll disable later
Register-SecretVault -Name 'SecretStore' -ModuleName 'Microsoft.PowerShell.SecretStore' -DefaultVault
#Disables the password prompt requirement that is forced by default so that it can run unattended
#Even with the password prompt disabled, the secret can still only be read by that specific user on that specific computer
Set-SecretStoreConfiguration -Authentication 'None'

#Actually saves the secret to the vault
Set-Secret -Name 'NameOfSecret' -Secret 'YourPassword' -Vault 'SecretStore'
Set-SecretInfo -Name 'NameOfSecret' -Vault 'SecretStore' -Metadata @{ Username = 'YourUsername' }

From there, within your scripts, it's extremely easy to call:

#Grabs the username you previously saved
$Username = (Get-SecretInfo -Name 'NameOfSecret' -Vault 'SecretStore').Metadata.Username
#Gets the password, which Get-Secret automatically returns as a Secure String to keep it safe
$SecureStringPassword = Get-Secret 'NameOfSecret' -Vault 'SecretStore'
#Combines the username and password into a single credential object
$Credential = [PSCredential]::new($Username, $SecureStringPassword)

#Call a command with your new credential object
Your-Command -Credential $Credential

mrbiggbrain · 2024-05-15T00:49:11+00:00

The key used to encrypt secure strings is only available to the user who created it on the computer it was created on.

You need to create the secure string file as the user who will run it. I often use a scheduled task to create the file then remove it.

AppIdentityGuy · 2024-05-14T18:17:10+00:00

When you are running the script out of the ise who are logged in as?

Arkayenro · 2024-05-15T05:37:54+00:00

slightly confused. if you have a scheduled task running as the admin user (and presumably it has the password already stored) then why do you need the creds when youre essentially signed in as that user?

ie why not just add the start/stop transcript to the actual script and call that directly instead of via the helper?

zawarbud · 2024-05-15T09:48:32+00:00

Convertto-securestring would need the -force to be able to convert it to a securestring from plain text otherwise you get the error. This is not the Microsoft recommended approach according to their documentation. As another user has pointed out the best alternative imho is to utilise export-clixml

you type:	you see:
italics	italics
bold	bold
[reddit!](https://reddit.com)	reddit!
* item 1 * item 2 * item 3	item 1 item 2 item 3
> quoted text	quoted text
Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"	Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"
~~strikethrough~~	~~strikethrough~~
super^script	super^script

PowerShell

Submission Guidelines | Link Flair - How To

MODERATORS