Search code examples
powershellwindows-server-2012-r2password-encryption

patch broke my saved powershell secure strings


I wonder if others noticed too. I have a powershell script connecting via new-pssession to some other machines (windows servers) and the credentials are saved as XML via

$credential = Get-Credential
$credential| export-clixml somepath.xml

After september updates it can no longer import those XML files because

Import-CliXml : Key not valid for use in specified state.

If I recreate them again with the same credential set it works again! But I see the string in there is different! Seems like some crypto have changed and I will have to recreate all those saved credentials :-\

Is it possible patch caused this or am I doing something else wrong?


Solution

  • As mentioned in comments, the encryption is based on current windows user (including password).

    To import the xml after changing windows password, you'll have to export it again first.

    There's a new vault module from MS to serve a similar purpose, but it's still a work-in-progress at the moment. Maybe more relevant to future readers.

    For more information - https://adamtheautomator.com/powershell-export-xml/
    https://en.wikipedia.org/wiki/Data_Protection_API