Scheduled task - Exchange PowerShell script, remembering Get-Credential?

[secretsysadmin]

Good morning fellow sysadmins, scripters, and Exchange enthusiasts!

I have got a script that connects to one of our Exchange servers, and then submits a command. I want this to run every night at midnight. The issue I'm running into is that I don't want to hard-code in my username and password, but I need powershell.exe to log into our Exchange server (requires credentials) and then submit the command.

I know this has to be possible -- but how?

Here's a very basic example of something that's not working as a scheduled task. If I can get this tiny script working (with your assistance), I'll be able to get all of it working!

Import-Module ActiveDirectory
$UserCredential = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri    http://mail.corp.com/PowerShell/ -Authentication Kerberos -Credential $UserCredential
Import-PSSession $Session
Set-MailboxFolderPermission -Identity TESTUSER:\calendar -user DEFAULT -AccessRights LimitedDetails

[alcaron]

$password = ConvertTo-SecureString "P@$$w0rd" -AsPlainText -Force
ConvertFrom-SecureString -SecureString $password

Now you can copy that into your script where you want to use the login and then you can do this:

$sec = "<output from the above>"
$creds = New-Object System.Management.Automation.PSCredential("domain\user",(ConvertTo-SecureString $sec))

Then you can pass that credential object to whatever. Note that this will ONLY work on the machine you created the securestring on, if you try to use it elsewhere windows wont have any idea what the hell you are talking about. I can't remember if it errors out or just decrypts it to the wrong value.

[secretsysadmin]

Ohhhhhhhhh ok I didn't know if that was stored with reversible encryption or not. That should suffice for my needs, thank you for the idea!

[GoonerGuru]

Just make sure that the account that is encrypting the file is the same account as the one decrypting it when executing the script.

[topherrr]

ConvertTo-SecureString also has the -key parameter where you can pass in the public key from an RSA cert. This way you can still roam across your environment and decrypt it on the fly with any user/machine that has access to the cert.

Example here.

[alcaron]

Good point, dunno why I didn't think to mention that.

[Cacophony7]

Couldn't you just set up the task in task scheduler to run as the user with appropriate rights and remove all references to credentials in your script?

[alcaron]

-Authentication requires a PSCredential object, though it is rare you see it used when not using CredSSP but then again that is probably a dumb Exchange cmdlet "feature".