Encrypt String with the Machine Key in Powershell?

Question

I want to Encrypt a password in Powershell to save it to a file. The ConvertTo-SecureString uses the current credentials to encrypt and decrypt the string.

I want to encrypt it with the local machine key (probably the SYSTEM account credentials) so every username on the same computer will be able to use the password.

I want the string to be undecryptable on other computers.

What is your use case? Preventing the password being visible in script files? — Lieven Keersmaekers
– Lieven Keersmaekers, Commented Sep 25, 2017 at 8:44
@LievenKeersmaekers Nope. For that base64 is fine. I want to prevent from other people being able to use the password if they grab the file (through an SMB or NFS share that was open by mistake). Only users that have access to the specific computer should have access to the password. — iTayb
– iTayb, Commented Sep 25, 2017 at 17:30

iTayb · Accepted Answer · 2017-09-25 08:02:49Z

13

It's possible to use the [Security.Cryptography.ProtectedData]::Protect function along with [Security.Cryptography.DataProtectionScope]::LocalMachine as the entity.

Code example:

Function Encrypt-WithMachineKey($s) {
    Add-Type -AssemblyName System.Security

    $bytes = [System.Text.Encoding]::Unicode.GetBytes($s)
    $SecureStr = [Security.Cryptography.ProtectedData]::Protect($bytes, $null, [Security.Cryptography.DataProtectionScope]::LocalMachine)
    $SecureStrBase64 = [System.Convert]::ToBase64String($SecureStr)
    return $SecureStrBase64
}

Function Decrypt-WithMachineKey($s) {
    Add-Type -AssemblyName System.Security

    $SecureStr = [System.Convert]::FromBase64String($s)
    $bytes = [Security.Cryptography.ProtectedData]::Unprotect($SecureStr, $null, [Security.Cryptography.DataProtectionScope]::LocalMachine)
    $Password = [System.Text.Encoding]::Unicode.GetString($bytes)
    return $Password
}

answered Sep 25, 2017 at 8:02

iTayb

12.9k26 gold badges89 silver badges139 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

duct_tape_coder Over a year ago

This is awesome! One question though: this "machine key", how long does it last? Is it like the AD Machine password that resets every 30 days? Or is it the primary certificate in the machine personal store? Or... something else?

iTayb Over a year ago

It is created on the installation on windows and does not expire. You can replace if manually I guess, but it's not something that will happen automatically

duct_tape_coder Over a year ago

Awesome, what about if CurrentUser is used instead of LocalMachine?

duct_tape_coder Over a year ago

Okay found this, a bit old but informative: support.microsoft.com/en-us/help/309408/… Also worth noting the risks of using DPAPI: harmj0y.net/blog/redteaming/…

Collectives™ on Stack Overflow

Encrypt String with the Machine Key in Powershell?

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related