Powershell：如何使用 Windows 服務從文字檔案讀取安全字串

Question

我使用 Powershell 將 vSphere 環境的憑證儲存到文字檔案中ConvertFrom-SecureString。我想使用以下命令在我的 powershell 腳本中使用此憑證：

$password4host = get-content C:\shutdown\HostsCred.txt | convertto-securestring

如果我想透過服務執行 powershell 腳本，我會收到無法從文字檔案中讀取憑證的錯誤。這似乎屬於這樣的事實：將安全字串保存在文字檔案中與將這些憑證保存到文字檔案的使用者綁定在一起。只有用戶自己才能解密憑證。

程式碼片段：

$time = ( get-date ).ToString('HH-mm-ss')
$date = ( get-date ).ToString('dd-MM-yyyy')
$logfile = New-Item -type file "C:\shutdown\ShutdownLog-$date-$time.txt" -Force
Import-Module -Name VMware.*
# Some variables
$vcenter = "10.10.10.10"
$username = "[email protected]"
$username4host = "fakeuser"
$cluster = "ESXi-Cluster"
$datacenter = "Datacenter"
$vCenterVMName = "VMware vCenter Server" #Name of vCenter VM
$StarWindVM1 = "Starwind-VM" #Name of first StarWind VM
$StarWindVM2 = "Starwind-VM (1)" #Name of second StarWind VM
$StarWind = "10.10.10.11" #IP address of one of StarWind VMs
$ESXIhost1 = "10.10.10.12" #Name of first ESXI Host
$ESXIhost2 = "10.10.10.13" #Name of second ESXI Host
try
{
    $password4vCenter = get-content C:\shutdown\vCenterCred.txt | convertto-securestring
}
catch
{
    Write-Host $_ -foreground red
    Add-Content $logfile "$(get-date -f dd/MM/yyyy) $(get-date -f HH:mm:ss) $_"
    exit
}
try
{
    $password4host = get-content C:\shutdown\vCenterCred.txt | convertto-securestring
}
catch
{
    Write-Host $_ -foreground red
    Add-Content $logfile "$(get-date -f dd/MM/yyyy) $(get-date -f HH:mm:ss) $_"
    exit
}
$tmp = get-content C:\Temp\HostsCred.txt | convertto-securestring
$password4Starwind = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($tmp)) 
$credentials = new-object System.Management.Automation.PSCredential $username, $password4vCenter
$credentials4host = new-object System.Management.Automation.PSCredential $username4host, $password4host
Write-Host ""
Write-Host "$(get-date -f dd/MM/yyyy) $(get-date -f HH:mm:ss) Shutdown command has been sent to the vCenter Server." -Foregroundcolor yellow
Write-Host "This script will shutdown all of the VMs and hosts located in $datacenter." -Foregroundcolor yellow
Write-Host ""
Sleep 5
Add-Content $logfile "$(get-date -f dd/MM/yyyy) $(get-date -f HH:mm:ss) PowerOff Script Engaged"
Add-Content $logfile ""
# Connect to vCenter
$counter = 0
if ($counter -eq 0){
       Set-PowerCLIConfiguration -InvalidCertificateAction ignore -Confirm:$false | Out-Null
}
Write-Host "Connecting to vCenter - $vcenter.... " -nonewline
Set-PowerCLIConfiguration -InvalidCertificateAction ignore -confirm:$false
Add-Content $logfile "$(get-date -f dd/MM/yyyy) $(get-date -f HH:mm:ss) Connecting to vCenter - $vcenter"
try
{
    $success = Connect-VIServer $vcenter -Credential $credentials -WarningAction:SilentlyContinue
}
catch
{
    Write-Host $_ -foreground red
    Add-Content $logfile "$(get-date -f dd/MM/yyyy) $(get-date -f HH:mm:ss) $_"
    exit
}

但我已經將該服務的登入使用者變更為儲存加密憑證的使用者。該服務似乎仍未以特定使用者身分執行，或無法將這些安全字串與 Windows 服務一起使用。

如果我在使用該使用者登入時從 powershell ISE 執行 powershell 腳本，它將運行該腳本，不會出現任何錯誤。

如何在透過 Windows 服務觸發的 powershell 中使用憑證，而不將它們以純文字形式儲存在 powershell 腳本內？