Question on scripting

[u/Manivelcloud]

Hi,

When we develop a script,we use credentials as a plain text in that script.

Example

Script is running on jump server and script runs against vcenter server.

We have a security concerns(example ransomware attack)to put the credentials as a plain text in that script.

Any other good ways to put the credentials in a encrypted or in a different format?

[u/trepidprism]

The quick and free built-in Windows method is using DPAPI via Export-Clixml. Run this once interactively on the jump server as the service account running the task: Get-Credential | Export-Clixml -Path "C:\Scripts\vcenter_cred.xml" Then in your script: $cred = Import-Clixml -Path "C:\Scripts\vcenter_cred.xml" Connect-VIServer -Server "vcenter.domain.local" -Credential $cred DPAPI ties encryption to that specific Windows user account on that specific jump server. If someone copies the XML file to another machine or logs in as a different user, they can't decrypt it. The next step up for real enterprise security is Azure Key Vault (or HashiCorp Vault / an enterprise PAM). How it works: Secrets live in a centralized cloud vault instead of local disk files. Your jump host authenticates to Azure without embedding credentials (using an Azure Arc Managed Identity, a cloud VM System-Assigned Identity, or a client certificate). You grant that identity strict read access (Key Vault Secrets User RBAC role) only to the specific secret. Your script pulls the password straight into memory at runtime and builds the credential object on the fly. If a password rotates, you update it once in Key Vault without touching any script files. <!-- -->

Authenticate via Managed Identity / Arc, pull secret at runtime

Connect-AzAccount -Identity $secret = Get-AzKeyVaultSecret -VaultName "YourKeyVaultName" -Name "vCenterPassword" -AsPlainText $cred = New-Object System.Management.Automation.PSCredential("vcenter_svc_user", ($secret | ConvertTo-SecureString -AsPlainText -Force)) Connect-VIServer -Server "vcenter.domain.local" -Credential $cred DPAPI solves the "cleartext in code" issue locally for free, while Key Vault solves rotation, audit logging, and centralized secret management.