How to protect PowerShell credentials in task automation
When administrators use unencrypted credentials in PowerShell scripts, they expose sensitive information. Find out the ways to secure credential use with automated tasks.
Task automation eases the administrator's workload, but the IT staff needs to be mindful of properly handling PowerShell credentials to avoid security issues.
Let's say you need to retrieve the BIOS firmware version of 50 infrastructure servers. You operate a Windows 10 administrative workstation under domain user credentials, but need the script to run under domain administrative privileges.
To automate this task, you write the simple PowerShell function shown in Figure 1, but there is a glaring problem in the code.
Figure 1. Our initial PowerShell script
The Get-BIOSInfo script works as expected. There is nothing inherently broken, but the issue is an exposed username/password credential set in plaintext. If a malicious user saw this file, they could hijack those credentials. Here are common workarounds to protect PowerShell credentials when running scripts.
Ways to secure PowerShell credentials
One way to authenticate PowerShell script permissions while preventing plaintext exposure is to generate the PSCredential object interactively.
Figure 2. Interactively capturing credentials
The advantage to this is that credentials aren't recorded in the source code. The disadvantage is that you need to run your script interactively. This isn't a workable solution if you need to schedule the script to run unattended.
Let's investigate the $cred variable below:
$cred.GetType()
IsPublic IsSerial Name BaseType
------ ------ --- ----
True True PSCredential System.Object
$cred.UserName
adminaccount
$cred.Password
System.Security.SecureString
Notice that PowerShell doesn't reveal the plaintext password contained in the Password property. There are ways to uncover that data, however.
One way to authenticate PowerShell script permissions while preventing plaintext exposure is to generate the PSCredential object interactively.
Another method involves storing passwords in a separate file.
A couple of PowerShell conversion cmdlets transformed the credentials into a secure string password. The Password property of a PSCredential object uses that data type.
PowerShell credentials get stored in encrypted form in a text file.
Figure 3. The encrypted password stored by PowerShell
The advantage to this is that credentials aren't recorded in the source code. The disadvantage is that you need to run your script interactively. This isn't a workable solution if you need to schedule the script to run unattended.
Let's investigate the $cred variable below:
$cred.GetType()
IsPublic IsSerial Name BaseType
-------- -------- ---- --------
True True PSCredential System.Object
$cred.UserName
adminaccount
$cred.Password
System.Security.SecureString
Notice that PowerShell doesn't reveal the plaintext password contained in the Password property. There are ways to uncover that data, however.
Another method involves storing passwords in a separate file.
A couple of PowerShell conversion cmdlets transformed the credentials into a secure string password. The Password property of a PSCredential object uses that data type.
PowerShell credentials get stored in encrypted form in a text file.
The advantage here is convenience, but the disadvantage is the need to protect the password file. For example, you could use NTFS file permissions and the Encrypting File System to prevent the file from falling into the wrong hands.
Credential Manager puts a lock on login credentials
Credential Manager is where Windows stores Windows and web credentials. It's another option to maintain control over login information when used in conjunction with PowerShell.
To open the Credential Manager with PowerShell, enter the following code from the PowerShell prompt:
Show-ControlPanelItem -Name 'Credential Manager'
Credential management with PowerShell
A developer named Dave Garnar wrote a great PowerShell module called CredentialManager that makes it easier to set and retrieve credentials from Credential Manager programmatically. Install the module by using PowerShellGet and the following code:
You then can use the New-StoredCredential cmdlet to create a new credential object and store it in Windows Credential Manager. Note that the -Persist parameter has three options.
Session: The credential remains in Credential Manager only during the active PowerShell session.
Local Machine: The credential remains in Credential Manager permanently as a Windows credential.
Enterprise: The credential remains in Credential Manager permanently as a web credential.
The -Target parameter is effectively a label. By combining Get-Credential and New-StoredCredental, we can define a session-persistent credential.
Figure 4 shows the refactored Get-BIOSInfo function code that uses Get-StoredCredential to retrieve the credential securely.
Figure 4. The adjusted PowerShell code retrieves credentials in a more secure manner.
If you have a Microsoft Azure subscription, then you can store and retrieve credentials by using Azure Key Vault. Adding a helper module, such as AxCredentialVault, makes it more convenient to work with the service.
