Basically, I want to cache the credentials needed for New-PSSession and make them available to scripts so they don't have to nag a human.
If I use export-clixml or similar to store a PSCredential on disk, how much of a risk of compromise does that add over keeping it in a session variable?
I'm new to DSC and trying to figure out how to make it work for us.
What I'm stuck on is how the credentials are actually protected. My current understanding is that it isn't all that great.
The big three problems are these. How does using a public key as a decryption source really protect those credentials? Which computers need the certificate in push and pull scenarios? What are the best practices for dealing with credentials in light of these issues?
Using a public key of a certificate is good for authenticating the source of a transmission. But using it as a decryption key means that access to the public key of the certificate determines access to the password.
If you have to push the cert to every computer that needs to decrypt MOF files, what is there to stop average users from getting access to the cert and being able to decrypt the MOF? Saying active directory security means that you may as well leave it in plain text and just rely on AD security.
Can someone help me get my head around this?
We're doing monthly updates to a disconnected network with Server 2012 installed on all servers.
Last month (February), the export created a 60 megabyte .xml.gz. Today, it creates a 0 byte file timestamped at the start of the export and the log's timestamp hits at the end of the process.
Any ideas where to look next? Google just returns results for the .cab 0 byte issue.
In the past, I've used WSUS 3 in disconnected mode by exporting updates from a server on the public internet and importing them to a server on a private totally disconnected network. Sophos has been used in the same way to provide anti-virus capabilities.
We're looking at a new Windows Server 2012 based network, but it isn't clear how to bring virus definitions for Endpoint Protection across to the offline network.
Are there any existing instructions available that I haven't been able to google up?