This is what I did to get it working for me.
Connection alias host is 127.0.0.1, so runs on the MID server.
try {
# this fails
# a temp generated script in %TEMP% (mid service account) for some strange reason strips out -credential $cred
# assumption is a parser preprocesses script and actively removes any traces
New-ADGroup -Name $failParam -GroupCategory Security -GroupScope Global -Path "ou=snow,dc=mylab,dc=com" -credential $cred
}
catch {
write-host "failed to create group because command was stripped of -credential $cred"
}
# $cred is a PSCredential object "magically" injected in by MID server agent
# to work around the parser we regenerate PSCredential object again
$userName = ($cred).username
$decryptedPassword = (New-Object PSCredential 0, $cred.Password).GetNetworkCredential().Password
$encryptedPassword = ConvertTo-SecureString -String $decryptedPassword -AsPlainText -Force
$customCredential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $userName, $encryptedPassword
try {
# despite command being exactly the same in above try statement this succeeds because we're using our custom PSCredential object
New-ADGroup -Name $someparam -GroupCategory Security -GroupScope Global -Path "ou=snow,dc=mylab,dc=com" -credential $customCredential
} catch {
Write-Host $_
}
Why does ServiceNow strip out `-credential $cred` from scripts, especially without stating somewhere it does this?
