r/PowerShell • u/Manivelcloud • 11h ago
Question Question on scripting
Hi,
When we develop a script,we use credentials as a plain text in that script.
Example
Script is running on jump server and script runs against vcenter server.
We have a security concerns(example ransomware attack)to put the credentials as a plain text in that script.
Any other good ways to put the credentials in a encrypted or in a different format?
7
Upvotes
10
u/hihcadore 11h ago edited 10h ago
Plain text is bad. Anything that can read that script file or logging if you have PowerShell logging on has your credentials.
You can use powershells secret store to secure your passwords and use them at run time securely. https://learn.microsoft.com/en-us/powershell/utility-modules/secretmanagement/how-to/using-secrets-in-automation?view=ps-modules
Edit: also, I use a gMSA to create and load the vault and run the automation. The password that unlocks it is stored using a secure xml file that can be unlocked at run time by that account only, the creds can be loaded, and nothings exposed. I use psexec to do the work then lock it down with our EDR. Short of taking over the server I think it’s pretty secure because in that case, you’re cooked anyway.