Take the 2-minute tour ×

I'm trying to create a script to completely automate joining the domain to use during a wds image deployment. I don't want to use the WAIK option because the password is stored in plain text in the xml file. So I've found some powershell scripts online that look like they could work.

This is the command I used to create my encrypted file which contains the password.

read-host -assecurestring | convertfrom-securestring | out-file C:\securestring.txt

Here's the script I'm using.

$domain = "MYDOMAIN.COM"
$password = cat C:\securestring.txt | ConvertTo-SecureString -Force
$username = "$domain\MYUSERNAME"
Add-Computer -DomainName $domain -Credential $credential

Here's the error I'm getting.

Windows PowerShell
Copyright (C) 2009 Microsoft Corporation. All rights reserved.

PS C:\> $domain = "MYDOMAIN.COM"
PS C:\> $password = cat C:\securestring.txt | ConvertTo-Secure
String -Force
ConvertTo-SecureString : Cannot process argument because the value of argument
"input" is invalid. Change the value of the "input" argument and run the operat
ion again.
At line:1 char:66
+ $password = cat C:\securestring.txt | ConvertTo-SecureString <<<<  -Force
+ CategoryInfo          : InvalidArgument: (:) [ConvertTo-SecureString], P
+ FullyQualifiedErrorId : ImportSecureString_InvalidArgument,Microsoft.Pow

share|improve this question

migrated from stackoverflow.com Jun 4 '13 at 14:25

This question came from our site for professional and enthusiast programmers.

That works for local accounts, but not for the password field for joining the domain. –  Brum Jun 3 '13 at 17:28
if someone really wants your pwd I don't believe(as far as i know) that secure-string would help much. You can encrypt it using a key, but the ps1 script has to be readable for everyone which makes the location of the key or the key itself + the pwd-dump available for everyone. Poeple who really wants the password would just need to run the same cmd as you have in the ps1 script –  Frode F. Jun 3 '13 at 17:41
I've seen similar errors with ConvertTo-Csv if there are certain kinds of errors with the content of the input file, such as trailing blanks. Sure enough, if you take a valid file created by piping a secure string to ConvertFrom-SecureString and add a space at the end, that reproduces the error you're getting. Try re-creating securestring.txt. If you still get the same error, try entering something like "test123" instead of your password. While that won't make your script work, it will help determine if there's some problem with the characters in your password or if it's something else. –  Adi Inbar Jun 3 '13 at 21:46
Another thought - maybe you have some default character encoding set that ConvertTo-SecureString doesn't like? Try this command to create your password file: read-host -assecurestring | convertfrom-securestring | out-file C:\securestring.txt -encoding ascii –  Adi Inbar Jun 3 '13 at 21:51

1 Answer 1

Secure strings only work for the user that created them. If you are creating C:\securestring.txt as one user and then trying to read it with a different user it won't work. Try creating the file with the same user that is going to read it.

share|improve this answer
If that were the issue, it would throw a "key not valid" error. I think it has something to do with the formatting of the file. –  Adi Inbar Jun 3 '13 at 21:48
I tried your script to create a new securestring.txt file and when running the same script as before I get the following error. ConvertTo-SecureString : Key not valid for use in specified state. At line:1 char:61 + $password = cat C:\securestring.txt | ConvertTo-SecureString <<<< -Force + CategoryInfo : InvalidArgument: (:) [ConvertTo-SecureString], CryptographicException + FullyQualifiedErrorId : ImportSecureString_InvalidArgument_CryptographicError,Microsoft.PowerShell.Comma‌​nds.ConvertToSecureStringCommand –  Brum Jun 4 '13 at 19:45

Your Answer


