{"id":711,"date":"2018-08-11T20:53:58","date_gmt":"2018-08-11T12:53:58","guid":{"rendered":"https:\/\/jacobcurulli.com\/?p=711"},"modified":"2019-08-11T20:58:22","modified_gmt":"2019-08-11T12:58:22","slug":"store-encrypted-credentials-for-powershell-scripts","status":"publish","type":"post","link":"https:\/\/jacobcurulli.com\/learning-technology\/store-encrypted-credentials-for-powershell-scripts\/","title":{"rendered":"Store Encrypted Credentials for PowerShell Scripts"},"content":{"rendered":"<p>As the need will often arise, I found myself wanting to automate yet another daily task but I came unstuck when needing to include credentials in the script. Now a completely hypothetical, much younger and inexperienced administrator may have just put the credentials in the script, plain-text and all, then told themselves it was on a secure system anyway&#8230;<\/p>\n<p>It&#8217;s one thing to include plain-text credentials when testing a script, but to put that into production isn&#8217;t just an awful idea, it&#8217;s downright terrifying. Thankfully PowerShell offers us a way to at least obfuscate and encrypt credentials. It&#8217;s not foolproof as anyone with access to the user account and machine used to encrypt the credentials can also decrypt them, but given that you are probably running this on a production sever as the admin user &#8211; you&#8217;ll have bigger issues if someone gains access to that account and system.<\/p>\n<p>Enter the &#8216;ConvertTo-SecureString&#8217; and &#8216;ConvertFrom-SecureString&#8217; cmdlet&#8230;<br \/>\nThese will allow you use the Windows Data Protection API (<a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/ms995355.aspx\">DPAPI<\/a>) to encrypt\/decrypt your strings. What this means is that the encrypted string can only be used on the same computer, but the same user account.<\/p>\n<p>Using a Read-Host prompt you can call for the password as a secure string, then write that out using a &#8216;Out-File&#8217; cmdlet.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"null\">Write-Host 'Input password:'\r\n$securePassword = Read-host -AsSecureString | ConvertFrom-SecureString\r\n  \r\n$securePassword | Out-File -FilePath \"Credential.cred\"<\/pre>\n<p>To read the credential back in you can use the &#8216;Get-Content&#8217; cmdlet as shown below in the snippet of some code I use to read the credential and then connect to my Azure tenant.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"null\">$PwdSecureString = Get-Content \"C:\\securecredential.cred\" | ConvertTo-SecureString       \r\n\r\n$Credential = New-Object System.Management.Automation.PSCredential -ArgumentList user@contoso.onmicrosoft.com, $PwdSecureString\r\n\r\n# Connect to Azure tenant\r\nConnect-MsOlService -Credential $Credential<\/pre>\n<p>More information on how to use the &#8216;ConvertTo-SecureString&#8217; cmdlet can be found in the <a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/microsoft.powershell.security\/convertto-securestring?view=powershell-6\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft PowerShell documentation<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>As the need will often arise, I found myself wanting to automate yet another daily task but I came unstuck when needing to include credentials in the script. Now a completely hypothetical, much younger and inexperienced administrator may have just put the credentials in the script, plain-text and all, then told themselves it was on [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":716,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3],"tags":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/jacobcurulli.com\/wp-json\/wp\/v2\/posts\/711"}],"collection":[{"href":"https:\/\/jacobcurulli.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jacobcurulli.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jacobcurulli.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jacobcurulli.com\/wp-json\/wp\/v2\/comments?post=711"}],"version-history":[{"count":4,"href":"https:\/\/jacobcurulli.com\/wp-json\/wp\/v2\/posts\/711\/revisions"}],"predecessor-version":[{"id":715,"href":"https:\/\/jacobcurulli.com\/wp-json\/wp\/v2\/posts\/711\/revisions\/715"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/jacobcurulli.com\/wp-json\/wp\/v2\/media\/716"}],"wp:attachment":[{"href":"https:\/\/jacobcurulli.com\/wp-json\/wp\/v2\/media?parent=711"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jacobcurulli.com\/wp-json\/wp\/v2\/categories?post=711"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jacobcurulli.com\/wp-json\/wp\/v2\/tags?post=711"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}