how to decrypt securestring remotely with winrs

[Frank]

Hi,

I have a situation where I need to store a password to be used in an
encrypted file to later be used by another script. I first store the
encrypted password in a file in a directory via:

read-host -prompt "Enter password to be decrypted in c:\test.txt"
-assecurestring | convertfrom-securestring | out-file c:\test.txt

Then, I decrypt the file and use in a script via:

$pass = cat c:\test.txt | convertto-securestring

$ptr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($pass)
$pass_back = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($ptr)

write-output "password decrpyted is: $pass_back"

This all works if I did both create password script and decrpyt password
script on the localbox but when I try to do this remotely via winrs, I get:

[C:\]: winrs `-r:testserver powershell.exe -nologo -noprofile d:\password2.ps1
ConvertTo-SecureString : The requested operation cannot be completed. The
comp
password decrpyted is: uter must be trusted for delegation and the current
user account must be configured to allow delegation.
At D:\password2.ps1:1 char:57
+ $pass = cat c:\securestring.txt | convertto-securestring <<<<
Exception calling "SecureStringToBSTR" with "1" argument(s): "Value cannot
be null.
Parameter name: s"
At D:\password2.ps1:3 char:68
+ $ptr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR( <<<<
$pa
ss)
Cannot convert argument "0", with value: "", for "PtrToStringAuto" to type
"Sys
tem.IntPtr": "Cannot convert null to type "System.IntPtr"."
At D:\scp\password2.ps1:4 char:71
+ $pass_back = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto( <<<<
$ptr)

Can anyone give me ideas on how to make this work?

Thanks in advance,

[Oisin (x0n) Grehan [MVP]]

Post by Frank
Hi,
I have a situation where I need to store a password to be used in an
encrypted file to later be used by another script.  I first store the
read-host -prompt "Enter password to be decrypted in c:\test.txt"
-assecurestring | convertfrom-securestring | out-file c:\test.txt
$pass = cat c:\test.txt | convertto-securestring
$ptr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($pass)
$pass_back = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($ptr)
write-output "password decrpyted is: $pass_back"
This all works if I did both create password script and decrpyt password
[C:\]: winrs `-r:testserver powershell.exe -nologo -noprofile d:\password2.ps1
ConvertTo-SecureString : The requested operation cannot be completed.  The
comp
password decrpyted is: uter must be trusted for delegation and the current
user account must be configured to allow delegation.
At D:\password2.ps1:1 char:57
+ $pass = cat c:\securestring.txt | convertto-securestring <<<<
Exception calling "SecureStringToBSTR" with "1" argument(s): "Value cannot
be null.
Parameter name: s"
At D:\password2.ps1:3 char:68
+ $ptr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR( <<<<
$pa
ss)
Cannot convert argument "0", with value: "", for "PtrToStringAuto" to type
"Sys
tem.IntPtr": "Cannot convert null to type "System.IntPtr"."
At D:\scp\password2.ps1:4 char:71
+ $pass_back = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto( <<<<
$ptr)
Can anyone give me ideas on how to make this work?
Thanks in advance,

You need to talk to your AD (active directory) administrator(s) and
show them the error message:

"The computer must be trusted for delegation and the current user
account must be configured to allow delegation."

If they don't understand this message, then they're not competent AD
administrators. Find someone who is. Sorry if this answer is a bit
terse, but explaining the message is beyond the scope of a usenet
post, and the answer will not help you get around it anyway unless you
were an AD admin. If you were an AD admin, you wouldn't be asking the
question ;-)

- Oisin