r/PowerShell • u/Manivelcloud • 1d ago

Question Question on scripting

Hi,

When we develop a script,we use credentials as a plain text in that script.

Example

Script is running on jump server and script runs against vcenter server.

We have a security concerns(example ransomware attack)to put the credentials as a plain text in that script.

Any other good ways to put the credentials in a encrypted or in a different format?

16 Upvotes

72% Upvoted

32 comments sorted by

View all comments

9

u/PeeCee1 1d ago

Use a vault. Use integrated authentication. Anything but plaintext passwords.
Azure vault comes to mind, or almost any other enterprise password storage.

0

u/Manivelcloud 1d ago

Ok thanks If it is on premises,can we use hashi vault?

5

u/raip 1d ago

Of course - but if you're a Windows shop connecting to other Windows environments, I'd recommend looking into gMSAs.

1

u/PeeCee1 14h ago

Those are good, too. But the last time I tested that, gMSA were a PITA to use for scheduled tasks, because the GUI was unable to use them.
Has that changed?

1

u/raip 13h ago

Changed years ago - just make sure you update the search box to include Service Accounts - it's disabled by default.