Storing and Using Encrypted Passwords with Powershell

There are lots of reasons why a username and password may be incorporated into a Powershell script - naturally, the quickest and easiest way to do this is to simply store the username and password in a script using a couple of variables such as;

$username = "user1"
$password = "password1"

Simple, and it works, but is definitely not secure.

There is a simple method you can use though to encrypt the password using powershell and store it as a text file on your computer. The password is encrypted using the currently logged in windows account that is running the powershell script (when you encrypt it) so keep this in mind if you are trying to decrypt the password with a different user account (because it won't work).

This is of course a 2 step process. The first step is to take your unsecured password (yourpassword) then encrypt it, and store the encrypted text value into a txt file (in C:\temp\user1-secpw.txt)

#Store Secure Credentials 

$unsecpw = "yourpassword"

$secpw = $unsecpw | convertto-securestring -asplaintext -force

$securestringtext = $secpw | convertfrom-securestring

set-content "C:\temp\user1-secpw.txt" $securestringtext

Once you've done this part and you have your password stored in the txt file, you should at the very least clear the value from the $unsecpw if you are saving this script - otherwise you're essentially defeating the purpose of encrypting it in the first place.

The second part is of course the process of importing the txt file into a new script so you can use the password. As previously mentioned, you will only be able to decrypt the password if you are executing the decryption commands under the same user security context (ie. windows user) as when you encrypted it.

$pwd = get-content "C:\temp\user1-secpw.txt" | convertto-securestring

$BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($pwd)

$Unsecpw = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)

Your password is now available to use via the $unsecpw variable

Automatically logoff sessions from windows server using Powershell

Windows server has the functionality through group policy to automatically log off users at a certain time of day, or once their set logon hours expire etc, but in my experience (and many other users based on internet research), it doesn't work very reliably.

Here is a script you  can use that will get a list of all current user sessions on a server, and log them off. A "safelist" is also included where you can specify usernames that should not be logged off automatically by this script - ie. administrator accounts etc. Usernames should be specified in inverted commas and separated by single commas.

I've also incorporated logging functionality, as it may be useful to know what users are staying logged onto the server (perhaps when they shouldn't be), and to be 100% certain about what the script is doing, or has done. Adjust the $logfile variable as required, or ensure the default folder (C:\Admin) exists for it to work correctly.

This does not require any additional modules to be installed either.

The script works by using the query session command, and then manipulating/formatting the results to obtain a list of current user sessions. Because the query session command is a DOS based command, the results aren't formatted nicely into variables/members that powershell can easily understand and work with, so formatting/manipulation is done using the .Substring and .Trim functions. The list of user sessions t hat is obtained is then compared against the safelist and if the user is not present in the safelist, is then logged off the server.

You will need to setup a scheduled task to run this powershell script - you can view my blog post here on setting up Powershell scripts to run via scheduled tasks in windows

$safelist = "administrator", "user1"
$date = get-date -f "ddMMyyyy"
$logfile = "C:\Admin\LogOffScript-$date.txt"

$sessions = query session |  where-object { $_ -notmatch '^ SESSIONNAME' } | %{
    $item = "" | Select "Active", "SessionName", "Username", "Id", "State", "Type", "Device"
    $item.Active = $_.Substring(0,1) -match '>'
    $item.SessionName = $_.Substring(1,18).Trim()
    $item.Username = $_.Substring(19,20).Trim()
    $item.Id = $_.Substring(39,9).Trim()
    $item.State = $_.Substring(48,8).Trim()
    $item.Type = $_.Substring(56,12).Trim()
    $item.Device = $_.Substring(68).Trim()
    $item
} 

foreach ($session in $sessions)
{
if ($safelist -notcontains $($session.username))
{
$time = get-date
logoff $($session.id)
write-output "$time | Logged off $($session.username)" | out-file $logfile -append
}
}

Apple iOS 10 Home Button Quick Unlock with Fingerprint - iPhone iPad

In the latest update to Apple's iPad/iPhone operating system (iOS 10), they have changed the behaviour of the lock screen.

You now need to press the home button your device in order to unlock it. There is a way however, to enable the functionality we had before iOS 10, where holding your finger on the home button (without pressing it) will unlock the device as well.

The option is somewhat hidden within the settings. To access it, do the following;

Go to Settings > General > Accessibility > Home Button and enable the option to Rest Finger to Open