# pre-encrypt credentials

**URL:** <https://forums.powershell.org/t/pre-encrypt-credentials/6544>\
**Category:** DSC\
**Created:** [May 30, 2016, 12:06am UTC](https://forums.powershell.org/t/pre-encrypt-credentials/6544 "2016-05-30T00:06:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![tim-ker](https://avatars.discourse-cdn.com/v4/letter/t/87869e/32.png) [@tim-ker](https://forums.powershell.org/u/tim-ker)\
**Post date:** [May 30, 2016, 12:06am UTC](https://forums.powershell.org/t/pre-encrypt-credentials/6544/1 "2016-05-30T00:06:49Z")

</div>

I am trying to pass in pre-encrpted credentails, instead of DSC encrypting actual username and password

`
 xWebAppPool someApool
 {
    identityType='SpecificUser'
   Credential = $Node.SomeEncryptedCredentail
 }
`

I have a cert with private key on the webserver, I would like to encrypt the password there and them put the encrypted cred or password in source control.

The public key credential is on the local authoring machine. DSC can encrypt locally mof no problem. Dsc on the webserver can decrypt no problem. But this requires me to have the password on the local authoring server, If possible I only want have the Web enrypted password on the local server.

This would stop me having to store the web apppool credentials anywhere but the web server

i.e how to create MSFT\_Credential without knowing the raw password on the authoring server  
`
instance of MSFT_Credential as $MSFT_Credential2ref
{
Password = “-----BEGIN CMS-----blah blah blah==\n-----END CMS-----”;
UserName = “someUser”;
};`

`
`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/powershell/original/1X/385e4f9fe133561ad30a814262fe0e0ae6bc3ef0.png) [@system](https://forums.powershell.org/u/system)\
**Post date:** [May 30, 2016, 6:27am UTC](https://forums.powershell.org/t/pre-encrypt-credentials/6544/2 "2016-05-30T06:27:30Z")

</div>

That’s an interesting idea. I don’t think there’s a way to do it yet, but maybe you could write a script that allows the author to just use some bogus password, then modifies the MOF file afterward with the proper encrypted value.

In the future, maybe Microsoft could modify the DSC module so that it looks for passwords that match the CMS format, and just pass them through as-is.

---

<div class="post-metadata">

**Author:** ![silent-steel](https://avatars.discourse-cdn.com/v4/letter/s/e5b9ba/32.png) [@silent-steel](https://forums.powershell.org/u/silent-steel)\
**Post date:** [May 31, 2016, 1:25pm UTC](https://forums.powershell.org/t/pre-encrypt-credentials/6544/3 "2016-05-31T13:25:13Z")

</div>

would this help (specifically the last part sample) ?

[https://msdn.microsoft.com/en-us/powershell/dsc/securemof#credential-encryption-module-example](https://msdn.microsoft.com/en-us/powershell/dsc/securemof#credential-encryption-module-example)

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 9:16pm UTC](https://forums.powershell.org/t/pre-encrypt-credentials/6544/4 "2024-05-16T21:16:58Z")

</div>

Closed on May 16, 2024, 9:16pm UTC