Want to add Get credentials

dinu03 · 2021-03-30T01:01:55.000Z

Hi,

I have attached Server health check script which has two parts in it one is for get credentials in secure way and another one ServerHealthReport main script to get server health check…

I want main script part ServerHealthReport have to get credentials from get credentials …let me know how we can do that …and also if possible can add to get multiple credentials because i don’t have domain credentials to run the main script, i have only local admins which is we have 3-different credentials, when i execute the script it has to check first credentials, if not working then second and then third credentials…

I want this very badly… kindly advise…

Thanks,

Dinu

Neally · 2021-03-30T01:07:47.000Z

DINU03:

I want main script

What have you tried? Where are you stuck?

If you post code, please use the ‘Insert Code’ button. Please and thank you!

https://community.spiceworks.com/topic/409427-please-read-before-post

dinu03 · 2021-03-30T01:14:18.000Z

i have attached codes top code is for get credentials and half of the code which below is main code (server health check) I have differeniated like #******************** Put Main Code here. The credentials you have stored is available as $credObject ***********#

i am not that much familiar with powershell…I need help here …

I want main script part ServerHealthReport have to get credentials from get credentials(top code) …let me know how we can do that …and also if possible can add to get multiple credentials because i don’t have domain credentials to run the main script, i have only local admins which is we have 3-different credentials, when i execute the script it has to check first credentials, if not working then second and then third credentials…

thomas-blake · 2021-03-30T05:26:10.000Z

Wow. That is a lot of code that I am not going to read. It seems the problem is that you found a script on the internet that you want to use, but don’t understand what it does. While, that can be ok in some instances, there is A LOT going on in the code that was posted.

I will answer your original question, though.

You can bind a credential object to a variable using the Get-Credential cmdlet.

$Credential = Get-Credential -Message "Input your credentials here"

After you have the credential object, you can use the object or its properties to authenticate to any system that requires it.

Get-WMIObject -Computername 'Computer01' -Class Win32_ComputerSystem -Credential $Credential

OR

Connect-Swis -Hostname 'SolarWindsServer' -Username $($Credential.Username) -Password $($Credential.GetNetworkCredential().Password)

If you are wanting a secure way to supply credentials automatically without user interaction (I.E. reading an encrypted credential from a text file and decrypting it for use in the script) that is a more advanced topic and would involve having certificates installed specifically for encrypting and decrypting text.

First, you need to create the certificate. I would go over that, but it is outside the scope of this discussion and frankly I don’t want to. Second you will need to reference the certificate in powershell and bind it to a variable.

$Certificate = Get-ChildItem Cert:\LocalMachine\My | Where-Object {$_.Subject -like "CN=<Certificate Name>*"}

Next you will take a plain text password and encrypt it using the previously mentioned certificate.

$Password = '<YourPlainTextPassword>'
$EncodedPassword = [system.text.encoding]::UTF8.GetBytes($Password)
$EncryptedBytes = $Cert.PublicKey.Key.Encrypt($EncodedPassword, $true)
$EncryptedPassword = [System.Convert]::ToBase64String($EncryptedBytes)
$EncryptedPassword | Out-File C:\Path\To\MyEncryptedPassword.txt

Once you have your encrypted password file, you can do the reverse to decrypt it and use in your script without the limitation of only being able to decrypt the credential file on the same computer with the same account. The only caveat is that you must have the certificate installed on all computers needing to decrypt the credential.

$EncryptedPassword = Get-Content -Path C:\Path\To\MyEncryptedPassword.txt
$EncryptedBytes = [System.Convert]::FromBase64String($EncryptedPassword)
$DecryptedBytes = $Cert.PrivateKey.Decrypt($EncryptedBytes, $true)
$DecryptedPassword = [system.text.encoding]::UTF8.GetString($DecryptedBytes)

dinu03 · 2021-03-30T22:17:13.000Z

Hi,

I have tried this method as you said :

Credential = Get-Credential -Message “Input your credentials here”

Get-WMIObject -Computername ‘Computer01’ -Class Win32_ComputerSystem -Credential $Credential

It is not working, i have tested with 10 machines, and changed password for 2 machines out of 10, script is running for all 10 machines it shows script did not consider the credentials, i can see the output for all 10 machines…

if any edit the above codes will be helpful…

Neally · 2021-03-30T22:22:57.000Z

If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don't say "Need help" or "PowerShell Help", actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy, past…

Neally · 2021-03-30T22:29:17.000Z

DINU03:

Credential = Get-Credential -Message “Input your credentials here”

Get-WMIObject -Computername ‘Computer01’ -Class Win32_ComputerSystem -Credential $Credential

It is not working,

If that’s literally what you have tried, your syntax is off, you missed the ‘$’ to make it a variable
‘it is not working’ does not help anyone. Give more details

DINU03:

i can see the output for all 10 machines

I’m a bit confused what is the issue if you see the output?

depending what you query and your setup , ‘get-wmiobject’ does not necessary need credentials.

You should test with ‘invoke-command’ or something over multiple domains, that would tell you more where it is going wrong.

Neally · 2021-03-30T22:30:30.000Z

In general for credentials, look

Here:

PowerShell Team – 25 Mar 21

SecretManagement and SecretStore are Generally Available - PowerShell Team

We are excited to announce two modules are now generally available on the PowerShell Gallery: Microsoft.PowerShell.SecretManagement Microsoft.PowerShell.SecretStore To install the modules, open any PowerShell console and run: Install-Module...

and here:

pdq.com

How to encrypt & secure passwords with PowerShell | PDQ

Automating is great with PowerShell until you need to pass credentials into a script. Learn how to secure passwords with PowerShell and automate protection.

pdq.com

How to share credentials between different users & machines with...

Secure password with PowerShell: Learn how to securely encrypt your passwords and automate your PowerShell scripts by using AES keys.

dinu03 · 2021-03-30T23:17:29.000Z

Thanks Neally for the link,

My issue is binding the credentials with main script… I have binded the credentils in as below :

$CPUavg = Get-WmiObject win32_processor -computername $ServerName -Credential $credObject

when i try to run the script if the system is having wrong password it should not collect the data’s but in my case it not…

Neally · 2021-03-30T23:56:31.000Z

seems to work for me ¯_(ツ)_/¯

2021-03-30_18-55-20.png800×351 105 KB

dinu03 · 2021-03-31T22:38:05.000Z

I have 10 machines with local admin credentials. 8 machines password are same, 2 machine password are different… I am running the script totally from different machine not from 10 machines…

When i try to execute the script as shown below. I am getting output for all 10 machines, suppose i have to get output only for 8 machines which have same credentials , where 2 machine password are different i have to get “Access denied” error…

So some where i am doing wrong in inputting the commands, I need expert advise here…

====================================================
Getting credentials from below script
===================================================
$KeyFile = "E:\Server_Health\Server_Health_Report\Credentials\AES.key"
$Key = New-Object Byte[] 16   # You can use 16, 24, or 32 for AES
[Security.Cryptography.RNGCryptoServiceProvider]::Create().GetBytes($Key)
$Key | out-file $KeyFile

$PasswordFile = "E:\Server_Health\Server_Health_Report\Credentials\Password.txt"
$KeyFile = "E:\Server_Health\Server_Health_Report\Credentials\AES.key"
$Key = Get-Content $KeyFile
$Password = "Welcome@2021" | ConvertTo-SecureString -AsPlainText -Force
$Password | ConvertFrom-SecureString -key $Key | Out-File $PasswordFile

$User = "Administrator"
$PasswordFile = "E:\Server_Health\Server_Health_Report\Credentials\Password.txt"
$KeyFile = "E:\Server_Health\Server_Health_Report\Credentials\AES.key"
$key = Get-Content $KeyFile
$MyCredential = New-Object -TypeName System.Management.Automation.PSCredential `
 -ArgumentList $User, (Get-Content $PasswordFile | ConvertTo-SecureString -Key $key)
 
 # Using the $MyCredential in practice.
Start-Process Powershell -ArgumentList "-File E:\Server_Health\Server_Health_Report\ServerHealthReport.ps1 -Verb runAs -Credential $MyCredential"
===================================================
Calling main script ServerHealthReport.ps1 using $MyCredential

Thanks,

S Dhinesh Kumar

gary-m-g · 2021-04-02T16:53:51.000Z

I scanned your code; I didn’t study it.
Once you define a variable and assign a value to it, just use it. Don’t copy & paste it again.
For instance:

$KeyFile = "E:\Server_Health\Server_Health_Report\Credentials\AES.key"

You created and assigned it. Now, just use it. Same with $PasswordFile.

You say you have 2 machines with different passwords; thus you may need two password files and you’ll need two credentials OR you can do the ones with one password, then replace the credentials for the remaining machines before authenticating to them.