I am trying to import a certificate on a VM.
I am doing the following script:
Start-VM -Name $NewVmName
Copy-VMFile -Name $NewVmName -SourcePath ".\certificate.pfx" -DestinationPath "C:\certificate.pfx" -CreateFullPath -FileSource Host
$Password = "test" | ConvertTo-SecureString -asPlainText -Force
Invoke-Command -VMName $NewVmName -Credential $LocalCredential -ScriptBlock {
Import-PfxCertificate -FilePath "C:\certificate.pfx" -CertStoreLocation Cert:\LocalMachine\My -Password $Password
}
So the certificate store location is indicated. However, when I run this script, Windows prompts me to know in which store I want to import the certificate:
How come? what do I do wrong? I want the certificate to be imported without any user interactions of course.
Thanks!
Related
How does one connect anonymously to an SMB share in powershell using New-PSDrive?
I've tried omitting the -Credential param but this seems to use the currently logged in user. This works when I test using a domain account, however the problem is for normal operation the currently logged in user is a local kiosk user for assigned access that the domain file server does not recognize.
I've also tried using the following, however it prompts for user input. As this is run as a scheduled task for background operation - this is unacceptable.
$Credentials = Get-Credential -UserName 'NTAUTHORITY\Anonymous Logon'
New-PSDrive -ErrorAction Stop -PSProvider "FileSystem" -Root "$RemoteFolder" -Name "$RemoteDriveLetter" -Credential $Credentials -Persist -Scope Global | Out-Null
I have enabled the local security policy option on the file server for "Network access: Let Everyone permissions apply to anonymous users".
How do I utilize the "anonymous" user connection with New-PSDrive?
-- edit --
I've also tried this
$Credentials = [pscredential]::Empty
New-PSDrive -ErrorAction Stop -PSProvider "FileSystem" -Root "$RemoteFolder" -Name "$RemoteDriveLetter" -Credential $Credentials -Persist -Scope Global | Out-Null
However, the output is:
>> TerminatingError(New-PSDrive): "The running command stopped because the preference variable "ErrorActionPreference" or common parameter is set to Stop: The specified network password is not correct"
The running command stopped because the preference variable "ErrorActionPreference" or common parameter is set to Stop: The specified network password is not correct
Anonymous mounts use an 'empty' user and password for the credential block so you can do the same.
This works for me and allows file creation on the share:
$User = " " # Create 'empty' username
$PWord = ConvertTo-SecureString -String " " -AsPlainText -Force
$Credentials = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $User, $PWord
New-PSDrive -PSProvider "FileSystem" -Root "$RemoteFolder" -Name "$RemoteDriveLetter" -Credential $Credentials -Persist -Scope Global | Out-Null
I'm building a VM image in Azure through automation pipelines using PowerShell. One of the requirements is to install a certificate on the CurrentUser store for a specific user. When I am currently logged into the VM, I can run the following command through Azure Run Commands:
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $User, $PWord
$session = New-PSSession $env:ComputerName -credential $Credential
$command = {
param($certPassword, $filePath)
Import-PfxCertificate -FilePath $filePath -CertStoreLocation Cert:\CurrentUser\My -Password $certPassword
}
Invoke-Command -ScriptBlock $command -ArgumentList $certPassword,$filePath -Session $session
When I am not currently logged into the VM under that user, I get an Access Denied error. The error goes away as soon as I login to the machine again. If I run the pipeline while I'm logged into the VM, it succeeds.
What is different about PowerShell permissions while I am logged into the VM?
The below code will prompt the user for the password but I want to insert a password in the script (hidden would be preferable). Therefore, the script will run with user inervention and will create and add the user to the admin group.
$Password = Read-Host -asSecureString
New-LocalUser -Name User -password $Password
Add-LocalGroupMember -Group "Administrators" -Member User
I modified the script to the below, however I received a secure script error:
New-LocalUser -Name User -password Password
Add-LocalGroupMember -Group "Administrators" -Member User
You can use ConvertTo-SecureString -AsPlainText -Force to convert a string value to a [SecureString] instance:
$Password = "th3d3f4ultP4$$W0rd!!!" |ConvertTo-SecureString -AsPlainText -Force
You can also try something like this (even leaving off the -UserName User on the Get-Credential if you want to prompt for both user and password:
# will prompt for password, store as secure string
$cred = Get-Credential -UserName User
New-LocalUser -Name $cred.UserName -Password $cred.Password
Add-LocalGroupMember -Group "Administrators" -Member $cred.UserName
I have a script block that I'm trying to make it run as a different domain user.
$Username = 'domain\test'
$Password = '1234'
$pass = ConvertTo-SecureString -AsPlainText $Password -Force
$cred = New-Object System.Management.Automation.PSCredential -ArgumentList $UserName,$pass
Invoke-Command -ScriptBlock{
write-host "hello"
} -Credential $cred -ComputerName $env:COMPUTERNAME
When I run it I got the following error:
[test-pc] Connecting to remote server test-pc failed with the following error message : The client cannot connect to the destination specified in the request. Verify that the service on the destination is running and is accepting requests.
Consult the logs and documentation for the WS-Management service running on the destination, most commonly IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to analyze and configure the WinRM se
rvice: "winrm quickconfig". For more information, see the about_Remote_Troubleshooting Help topic.
Why the script is trying to authenticate locally and not against the DC ?
Thanks
If you don't actually want to run the script remotely, you can use Start-Process to run Powershell as another user, which will then execute your command/script as that user.
(See powershell command line help for full syntax options and examples)
# Using Get-Credential to illustrate, substitute with your own credential code
$cred = Get-Credential
# Run Command:
Start-Process -FilePath Powershell -Credential $cred -ArgumentList '-Command', 'Write-Host "Hello"'
# Run Script:
Start-Process -FilePath Powershell -Credential $cred -ArgumentList '-File', 'C:\folder\script.ps1'
I am having an issue to connect to the remote server using New-PSDrive. The remote server is Windows-based, and only userA has access to write.
By saying that, the following code throws an "access denied" error:
Access to the path '$remoteServerPath' is denied on line3
Code:
New-PSDrive -Name remote -Root $remoteServerPath -PSProvider FileSystem
$destination = [IO.Path]::Combine('remote:', $fileName)
Copy-Item -Path $source -Destination $destination -Force
Now, I am trying to include credential information, but I get a different error!
The network path was not found on line3
$secpass = ConvertTo-SecureString 'myPassword' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential ('domain\userA', $secpass)
New-PSDrive -Name remote -Root $remoteServerPath-PSProvider FileSystem -Credential $cred
$destination = [IO.Path]::Combine('remote:', $fileName)
Copy-Item -Path $source -Destination $destination -Force
Can anyone please help me out? Powershell Ver. 5
Why are you creating a PSDrive for this task?
& NET USE Z: \\server\path /user:domain\UserA 'PASSWORD'
Copy-Item -Path $Source -Destination 'Z:\' -Force
& NET USE Z: /D
If you have their plaintext password, this should work just fine.