Scheduled PowerShell script secret management

Question

Hello, I need to run my PS scheduled scripts in a secured fashion. My PS server is not exposed to Internet. I would like to use some Password Vault mechanism with the scheduled scripts, and I know Windows has the Secret Store and Secret Management modules available but nowhere I read how secure they are. In our environment security is taken seriously. Basically the question is... what product do you use ?

Answer 1

Hello

Thank you for your question and reaching out. I can understand you are having query related to PowerShell using Task scheduler.

You can use gMSA accounts achieve this goal , in which password will be not saved in that Server or Credentials Manager , rater it will be get from AD.

Reference:
https://social.technet.microsoft.com/Forums/windows/en-US/42273a38-05dc-4f62-b915-8f55480d59bd/how-do-i-use-a-group-managed-service-account-with-the-task-scheduler?forum=winserver8gen

https://social.technet.microsoft.com/Forums/en-US/35c74606-df61-4eb9-a070-d819f08fbdbe/schedule-a-task-using-gmsa?forum=winservergen

-----------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept as answer--

Answer 2

I've simplified the question ...

Answer 3

Hi,

You can definetly use tried and tested method of the secure password file and here is the script that I use too read-write-encrypted-password-file-in-powershell-script.html

Also there is good document for PS security - ScriptRunner_Security_Webinar_2020_06.pdf

==
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
----
Please don't forget to upvote and Accept as answer if the reply is helpful

Answer 4

No problem, it works for our environment and does the job as we have other security measures in place like Azure Bastion and Conditional Access policies, RBAC, PIM, Sentinel monitoring to cover all the aspects of Security. Hope this helps and we are working on this article and recommendations secretmanagement-and-secretstore-are-generally-available

==
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
----
Please don't forget to upvote and Accept as answer if the reply is helpful

Answer 5

No worries and good luck Sig.

==
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.