<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Huddled Masses &#187; Credentials</title>
	<atom:link href="http://huddledmasses.org/tag/credentials/feed/" rel="self" type="application/rss+xml" />
	<link>http://huddledmasses.org</link>
	<description>You can do more than breathe for free...</description>
	<lastBuildDate>Sat, 28 Jan 2012 21:37:20 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
<cloud domain='huddledmasses.org' port='80' path='/?rsscloud=notify' registerProcedure='' protocol='http-post' />
		<item>
		<title>Using alternate credentials with the FileSystem in PowerShell</title>
		<link>http://huddledmasses.org/using-alternate-credentials-with-the-filesystem-in-powershell/</link>
		<comments>http://huddledmasses.org/using-alternate-credentials-with-the-filesystem-in-powershell/#comments</comments>
		<pubDate>Fri, 21 May 2010 04:53:55 +0000</pubDate>
		<dc:creator>Joel 'Jaykul' Bennett</dc:creator>
				<category><![CDATA[Huddled]]></category>
		<category><![CDATA[Add-Type]]></category>
		<category><![CDATA[Credentials]]></category>
		<category><![CDATA[FileShare]]></category>
		<category><![CDATA[PInvoke]]></category>
		<category><![CDATA[Server]]></category>
		<category><![CDATA[UNC]]></category>
		<category><![CDATA[Windows PowerShell]]></category>

		<guid isPermaLink="false">http://huddledmasses.org/?p=1478</guid>
		<description><![CDATA[In PowerShell, cmdlets like Get-ChildItem and Get-Content support a -Credential parameter so you can access resources that require you to log in&#8230; the problem is that the built-in FileSystem provider does not. So as an example, if you have a server on a different domain and you want to copy files off of it, you [...]]]></description>
			<content:encoded><![CDATA[	<p>In PowerShell, cmdlets like Get-ChildItem and Get-Content support a -Credential parameter so you can access resources that require you to log in&#8230; the problem is that the built-in FileSystem provider does not. So as an example, if you have a server on a different domain and you want to copy files off of it, you can&#8217;t do this:</p>

	<div class="posh code posh" style="font-family:monospace;"><span style="color: #660033; font-weight: bold;">$cred</span> <span style="color: #66cc66;">=</span> <span style="color: #0066cc; font-style: italic;">Get-<span style="font-style: normal;">Credential</span></span><br />
<span style="color: #0066cc; font-style: italic;">Copy-<span style="font-style: normal;">Item</span></span> \Server\Share\Folder\<span style="color: #66cc66;">*</span>.<span style="color: #003366;">log</span> C:\Logs <span style="color: #000066;">-Credential</span> <span style="color: #660033; font-weight: bold;">$cred</span></div>

	<p>That will throw an error: &#8220;Cannot retrieve the dynamic parameters for the cmdlet. The provider does not support the use of credentials. Perform the operation again without specifying credentials.&#8221;</p>

	<h4>Impersonation</h4>

	<p>To solve this problem at work, I&#8217;ve written an impersonation module. It basically has two methods: Push-ImpersonationContext and Pop-ImpersonationContext. There is one catch: you need to be running in <strong>single-threaded</strong> apartment mode for it to work, because the impersonation only affects the current <a class="zem_slink" href="http://en.wikipedia.org/wiki/Thread_%28computer_science%29" title="Thread (computer science)" rel="wikipedia">thread</a> (if you&#8217;re not running <code>PowerShell.exe -STA</code>, your commands execute on a <a class="zem_slink" href="http://en.wikipedia.org/wiki/Thread_pool_pattern" title="Thread pool pattern" rel="wikipedia">thread pool</a>, so you never know from one to the next what thread you&#8217;ll be on). In any case, you use it like this:</p>

	<div class="posh code posh" style="font-family:monospace;"><span style="color: #660033; font-weight: bold;">$cred</span> <span style="color: #66cc66;">=</span> <span style="color: #0066cc; font-style: italic;">Get-<span style="font-style: normal;">Credential</span></span><br />
<span style="color: #0066cc; font-style: italic;">Push-<span style="font-style: normal;">ImpersonationContext</span></span> <span style="color: #660033; font-weight: bold;">$cred</span><br />
<span style="color: #0066cc; font-style: italic;">Copy-<span style="font-style: normal;">Item</span></span> \Server\Share\Folder\<span style="color: #66cc66;">*</span>.<span style="color: #003366;">log</span> C:\Logs<br />
<span style="color: #0066cc; font-style: italic;">Pop-<span style="font-style: normal;">ImpersonationContext</span></span><br />
&nbsp;</div>

	<p>It&#8217;s really very simple, and works great for when you need to access resources across multiple domains. Particularly files, for which PowerShell doesn&#8217;t support alternate credentials at all.  <img src='http://huddledmasses.org/wordpress/wp-includes/' alt=':(' class='wp-smiley' />   Anyway the module code is on PoshCode, save it to your Documents\WindowsPowerShell\Modules\Impersonation\Impersonation.psm1 and use <code>Import-Module Impersonation</code> to load it.  Here you go:</p>

	<p><script type="text/javascript" src="http://PoshCode.org/embed/1867"></script></p>

<div class="zemanta-pixie"><a class="zemanta-pixie-a" href="http://reblog.zemanta.com/zemified/b2807eb4-e4ea-4df2-8125-5b136d68ce3d/" title="Reblog this post [with Zemanta]"><img class="zemanta-pixie-img" src="http://img.zemanta.com/reblog_e.png?x-id=b2807eb4-e4ea-4df2-8125-5b136d68ce3d" alt="Reblog this post [with Zemanta]" /></a><span class="zem-script more-related pretty-attribution"><script type="text/javascript" src="http://static.zemanta.com/readside/loader.js" defer="defer"></script></span></div>]]></content:encoded>
			<wfw:commentRss>http://huddledmasses.org/using-alternate-credentials-with-the-filesystem-in-powershell/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>A Better Get-Credential in one line of code</title>
		<link>http://huddledmasses.org/a-better-get-credential-in-one-line-of-code/</link>
		<comments>http://huddledmasses.org/a-better-get-credential-in-one-line-of-code/#comments</comments>
		<pubDate>Mon, 17 Nov 2008 21:14:54 +0000</pubDate>
		<dc:creator>Joel 'Jaykul' Bennett</dc:creator>
				<category><![CDATA[Huddled]]></category>
		<category><![CDATA[Bugs]]></category>
		<category><![CDATA[Console]]></category>
		<category><![CDATA[Credentials]]></category>
		<category><![CDATA[PowerShell]]></category>
		<category><![CDATA[Scripting]]></category>
		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://huddledmasses.org/a-better-get-credential-in-one-line-of-code/</guid>
		<description><![CDATA[For too long I have ignored the deficiencies in Get-Credential, so now I am going to fix them. Ready? function Get-Credential&#40;$caption,$msg,$domain,$name&#41;&#123;$Host.UI.PromptForCredential&#40;$caption,$msg,$name,$domain&#41;&#125; Ok, that&#8217;s better than the default, whew! At least you can specify the prompt text and the domain and default user name &#8230; but there are so many other options that are missing from [...]]]></description>
			<content:encoded><![CDATA[	<p>For too long I have ignored the deficiencies in Get-Credential, so now I am going to fix them. Ready?</p>

	<div class="posh code posh" style="font-family:monospace;"><br />
<span style="color: #666699; font-weight: bold;">function</span> <span style="color: #0066cc; font-style: italic;">Get-<span style="font-style: normal;">Credential</span></span><span style="color: #333;">&#40;</span><span style="color: #660033; font-weight: bold;">$caption</span>,<span style="color: #660033; font-weight: bold;">$msg</span>,<span style="color: #660033; font-weight: bold;">$domain</span>,<span style="color: #660033; font-weight: bold;">$name</span><span style="color: #333;">&#41;</span><span style="color: #333;">&#123;</span><span style="color: #660033; font-weight: bold;">$Host</span>.<span style="color: #003366;">UI</span>.<span style="color: #003366;">PromptForCredential</span><span style="color: #333;">&#40;</span><span style="color: #660033; font-weight: bold;">$caption</span>,<span style="color: #660033; font-weight: bold;">$msg</span>,<span style="color: #660033; font-weight: bold;">$name</span>,<span style="color: #660033; font-weight: bold;">$domain</span><span style="color: #333;">&#41;</span><span style="color: #333;">&#125;</span></div>

	<p>Ok, that&#8217;s better than the default, whew!  <img src='http://huddledmasses.org/wordpress/wp-includes/' alt=';)' class='wp-smiley' />  At least you can specify the prompt text and the domain and default user name &#8230; but there are so many other options that are missing from that dialog &#8212;like remembering my credentials for goodness sakes. I know many places forbid using the &#8220;remember&#8221; option for credentials, but why is that decision not up to me?</p>

	<p>Well, I can&#8217;t make all of those options appear (at least, not without compiling a pinvoke function to call the Win32 <span class="caps">API</span>) nor can I force PowerShell to use the <a href="http://msdn.microsoft.com/en-us/library/aa375178(VS.85).aspx">new Vista/2008 Credential function</a> (which is Common Criteria compliant in Vista) instead of the older <a href="http://msdn.microsoft.com/en-us/library/aa375177(VS.85).aspx">CredUIPromptForCredentials</a> ... but I can give you the <a href="https://connect.microsoft.com/feedback/ViewFeedback.aspx?FeedbackID=370658&#38;SiteID=99">most requested feature</a> for Get-Credential: a -Console option to force the prompt to happen in the console instead of in a &#8220;CredUI&#8221; pop up.  </p>

	<p> <img src='http://huddledmasses.org/wordpress/wp-includes/' alt='[new]' class='wp-smiley' />  <strong>Note:</strong> I kind-of messed up here, this will break if you&#8217;re used to using the -Credential parameter for Get-Credential to provide a default user name.  I&#8217;ll fix it shortly.</p>

	<p><script type="text/javascript" src="http://PoshCode.org/embed/681"></script></p>]]></content:encoded>
			<wfw:commentRss>http://huddledmasses.org/a-better-get-credential-in-one-line-of-code/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

