It is sometimes necessary to use plaintext passwords in PowerShell scripts, but obviously not a good idea to have those passwords stored in cleartext on disk. The solution is to use the PowerShell
ConvertTo-SecureString and
ConvertFrom-SecureString cmdlets to encrypt the password, save it to a file, and then decrypt it in memory when required. I ported
this function to PowerShell for properly converting the SecureString to a string.
The code below uses the default encryption method, which is specific to the logged in user (or, more precisely, the user that is running the code). Note that, for machines that have joined a domain, a domain administrator can decrypt your data by resetting your password. No other users can decrypt your data.
Encrypt password and save to a file
$secureStringPassword = Read-Host "Enter the password" -AsSecureString
$encryptedPassword = ConvertFrom-SecureString $secureStringPassword
Set-Content -Path Password.bin -Value $encryptedPassword
Load and decrypt the password in memory
function ConvertToUnsecureString(
[System.Security.SecureString][parameter(mandatory=$true)]$SecurePassword)
{
$unmanagedString = [System.IntPtr]::Zero;
try
{
$unmanagedString = [Runtime.InteropServices.Marshal]::SecureStringToGlobalAllocUnicode($SecurePassword)
return [Runtime.InteropServices.Marshal]::PtrToStringUni($unmanagedString)
}
finally
{
[Runtime.InteropServices.Marshal]::ZeroFreeGlobalAllocUnicode($unmanagedString)
}
}
$encryptedPassword = Get-Content -Path Password.bin
$secureStringPassword = ConvertTo-SecureString -String $encryptedPassword
$password = ConvertToUnsecureString $secureStringPassword
