Question

我使用PowerShell 2.0（因SP2010而必需）在Windows Server 2008 R2上。我需要从Windows Credential Manager检索进程的凭据。我似乎无法使其发挥作用。

我得到了这段代码：

[Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
(new-object Windows.Security.Credentials.PasswordVault).RetrieveAll() | % { $_.RetrievePassword(); $_ }

这两行代码都会抛出错误

Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime : Unable to find type [Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]: make sure that the assembly containing this type is loaded.

和

(new-object Windows.Security.Credentials.PasswordVault).RetrieveAll() | % {$_.RetrievePassword(); $_ }

分别。我一直试图以某种方式导入PasswordVault类。到目前为止谷歌已经让我失望了，我甚至无法找到它所在的集会。我错过了什么？

Answer 1

在powershell5中输入：

   Install-Module CredentialManager -force

然后

   New-StoredCredential -Target $url -Username $ENV:Username -Pass ....

以后

   Get-StoredCredential -Target ....

Answer 2

您需要访问Win32 API才能与Credential Manager进行交互。

CredMan.ps1 from the Technet scripting gallery很好地证明了这一点。

对于更简单的使用模式，例如仅列出主体或添加新凭据，您还可以使用cmdkey，一个用于凭据管理的内置Windows命令行实用程序

为了在PowerShell中重用存储的凭据，这个人似乎找到了一种方法，使用类似于CredMan.ps1的技术从Credential Store的Generic Credential句柄构建PSCredential：{{3 }}

Answer 3

根据文档，Windows Server 2008 R2不支持PasswordVault类。

支持的最低服务器 Windows Server 2012

https://msdn.microsoft.com/library/windows/apps/windows.security.credentials.passwordvault.aspx

Answer 4

我发现一个很好的帖子，此代码将打印所有用户名，资源和密码

[Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
$vault = New-Object Windows.Security.Credentials.PasswordVault
$vault.RetrieveAll() | % { $_.RetrievePassword();$_ }

贷记Todd's post

Answer 5

如果有人只想要一个代码片段，以便他们可以分发脚本而无需指导最终用户安装模块或包含 DLL 文件，那么这应该可以解决问题。

$code = @"
using System.Text;
using System;
using System.Runtime.InteropServices;

namespace CredManager {
  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
  public struct CredentialMem
  {
    public int flags;
    public int type;
    public string targetName;
    public string comment;
    public System.Runtime.InteropServices.ComTypes.FILETIME lastWritten; // .NET 2.0
    public int credentialBlobSize;
    public IntPtr credentialBlob;
    public int persist;
    public int attributeCount;
    public IntPtr credAttribute;
    public string targetAlias;
    public string userName;
  }

  public class Credential {
    public string target;
    public string username;
    public string password;
    public Credential(string target, string username, string password) {
      this.target = target;
      this.username = username;
      this.password = password;
    }
  }

  public class Util
  {
    [DllImport("advapi32.dll", EntryPoint = "CredReadW", CharSet = CharSet.Unicode, SetLastError = true)]
    private static extern bool CredRead(string target, int type, int reservedFlag, out IntPtr credentialPtr);

    public static Credential GetUserCredential(string target)
    {
      CredentialMem credMem;
      IntPtr credPtr;

      if (CredRead(target, 1, 0, out credPtr))
      {
        credMem = Marshal.PtrToStructure<CredentialMem>(credPtr);
        byte[] passwordBytes = new byte[credMem.credentialBlobSize];
        Marshal.Copy(credMem.credentialBlob, passwordBytes, 0, credMem.credentialBlobSize);
        Credential cred = new Credential(credMem.targetName, credMem.userName, Encoding.Unicode.GetString(passwordBytes));
        return cred;
      } else {
        throw new Exception("Failed to retrieve credentials");
      }
    }

    [DllImport("Advapi32.dll", SetLastError = true, EntryPoint = "CredWriteW", CharSet = CharSet.Unicode)]
    private static extern bool CredWrite([In] ref CredentialMem userCredential, [In] int flags);

    public static void SetUserCredential(string target, string userName, string password)
    {
      CredentialMem userCredential = new CredentialMem();

      userCredential.targetName = target;
      userCredential.type = 1;
      userCredential.userName = userName;
      userCredential.attributeCount = 0;
      userCredential.persist = 3;
      byte[] bpassword = Encoding.Unicode.GetBytes(password);
      userCredential.credentialBlobSize = (int)bpassword.Length;
      userCredential.credentialBlob = Marshal.StringToCoTaskMemUni(password);
      if (!CredWrite(ref userCredential, 0))
      {
        throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
      }
    }
  }
}
"@
Add-Type -TypeDefinition $code -Language CSharp
# How to store credentials
[CredManager.Util]::SetUserCredential("Application Name", "Username", "Password")
# How to retrieve credentials
[CredManager.Util]::GetUserCredential("Application Name")
# How to just get the password
[CredManager.Util]::GetUserCredential("Application Name").password

以上代码已在 PowerShell 7 和 PowerShell 5 上进行了测试，但如果您使用后者，则可能需要更新版本的 .Net 框架。

Answer 6

Microsoft正在开发一个SecretsManagement模块：https://devblogs.microsoft.com/powershell/secrets-management-development-release/ https://devblogs.microsoft.com/powershell/secrets-management-module-vault-extensions/

从PowerShell访问Windows凭据管理器

6 个答案: