Powershell Activity - Run As

Bruno_Serafim

Add the possibility to run powershell activities with another account.

This will be truly helpful to do non scsm tasks like AD tasks without storing the creds in clear in the script. Or even without doing something like that : https://blogs.technet.microsoft.com/robcost/2008/05/01/powershell-tip-storing-and-using-password-credentials/

Roland_Kind

as a possible workaround to avoid clear text cred in PS and avoiding a file store you can use the following approach:

## convert password strings to secure string and create encrypted string from secure string
##
## $key= (12,34,45,78,91,121,143,242,113,16,32,23,42,54,33,233,1,34,212,72,62,51,135,143) # 192 bit key --> this is important so that the hashed pw can be used on every computer - without a given key, the hash can only be used on the computer where the hash has been generated

## $sc=ConvertTo-SecureString 'yourPlainTextPasswordString' -AsPlainText -Force
## $st=ConvertFrom-SecureString -SecureString $sc -Key $key
##

## this have to be done once

your pS script only contains:
  
# 

$key= (12,34,45,78,91,121,143,242,113,16,32,23,42,54,33,233,1,34,212,72,62,51,135,143)
$secString_wf="76492d1116743f04234...... "  #string output from ConvertFrom-SecureString ...
$password_wf = ConvertTo-SecureString -String $secString_wf -key $key
$username_wf = "username"

Bruno_Serafim

Hi Roland,

Thank you for your answer.

Just a question, where is stored the hashed password ?

Roland_Kind

Hi Bruno,

the password hash is stored in the PS script itself  e.g. in the var $secString_wf as shown in the example above. Of course - I know, it is not 100% secure - but - and that was my intention - better than clear text password.