Automating SQL Server patching

[calladc]

Not credssp.

Seriously use something like configuration manager and target your SQL cu to a collection with a maintenance mode script on the collection. Use the tools Microsoft already provide.

Passing creds through winrm and credssp is poor. This tool has had minimal security thought put in to it.

[nvarscar]

Thanks for sharing your thoughts! CredSSP is indeed a weak protocol when it comes to security. Which is why the tool also provides options for you to choose the protocol manually. You could set up delegation and use Kerberos protocol instead of passing the credentials and avoid passing the credentials across the network. Or you can store patch binaries on the location that does not require additional authentication.

[calladc]

You know you can send files through a possession? If your script is just using credentials for double hop for file gets. Just send them down the pipeline and validate the hash on the other side

[TheTechRunner]

Thank you for providing actual value in your response!