Unable to pass param to ConvertTo-SecureString, only script defined variable

Question

This one has been confusing me or the last couple of days. Unable to pass param to ConvertTo-SecureString, only script defined variable.

When I run a script I pass a number of params. On of the tasks it needs to do is connect to a remote machine via PSSession, i.e.

./myscript.ps1 -VMPass "12345@!" -VMuser abc

In my script I have the following which will be passed to New-PSSession:

[CmdletBinding()] 
Param(
    $VMuser,
    $VMPass
)

$PWord = ConvertTo-SecureString -AsPlainText -String "$VMPass" -Force
$cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $VMuser, $PWord
$NewVMSession = (New-PSSession -ComputerName $NewVMAddress -Credential $cred -ErrorAction Stop)

When I run this I get the following error:

New-PSSession : [WIN-V2BK0KCPC7H] Connecting to remote server WIN-V2BK0KCPC7H
failed with the following error message : Access is denied. For more information,
see the about_Remote_Troubleshooting Help topic.
At C:\Users\ChildsC\Documents\Git\BAIC\Controller.ps1:85 char:26
+ ... MSession = (New-PSSession -ComputerName $NewVMAddress -Credential $vm ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-PSSession], PSRemotingTransportException
    + FullyQualifiedErrorId : AccessDenied,PSSessionOpenFailed

However, if I were to explicitly define $VMPass = "12345@!" in the script OR if I were to call Get-Credential it works fine.

So there is a small issue in the way the param is being passed.

Why are you passing the password to the function as plain-text? You can avoid the whole problem by passing a PSCredential object instead. — Bill_Stewart
Hallo sorry for the late response. I am creating a PSCredential using the inputs. Is there a better way to do this? bearing in mind that this script will be run from gitlab and that has the ability to hold secure credentials which would be decrypted and passed. — Explicitsoul

Adam Parsons Adam Parsons · Accepted Answer · 2018-05-27T09:34:27

To be sure the authentication attempt is valid, remember to format your domain credential username as DomainName\UserName. You may also need to provide an appropriate -Authentication parameter value to your New-PSSession cmdlet.

There are a number of authentication options available, and you can read more about them & WinRM authentication in general over at MSDN - https://msdn.microsoft.com/en-us/library/aa384295(v=vs.85).aspx

There's no immediate reason to believe the syntax for your script is at fault, however, if the above doesn't help perhaps we can look at that.

Unable to pass param to ConvertTo-SecureString, only script defined variable

2 Answers