Set-Secret | Get-Secret

This page covers using the Secrets feature in DeployR to securely pull secrets from the server to use in a task sequence

In DeployR 1.2 the options to create secrets on the server and use in a task sequence was introduced. Currently a couple of native steps in DeployR use this method which can be used as samples as well.

• Enable Administrator account [EnableAdmin.ps1]

• Enable Bitlocker [EnableBitlcoker.ps1]

Get-Secret and Set-Secret are part of the Microsoft.PowerShell.SecretManagement module, which we ship with DeployR to ensure it doesn't need to be fetched from the internet from a client that doesn't have internet access.

It provides authenticated access to the values (using the standard DeployR auth mechanisms). Values are stored in the server database and can then be retrieved by a client, used, and discarded without ever needing to write them to disk, which makes it impossible to retrieve post OSD and much more secure than embedding credentials in a script or even setting it in a task sequence variable.

Create Secret

Connect to the DeployR server via the PS Module, and use the Set-Secret command

Set-Secret -Name "DellBIOSPassword" -Secret "P@ssw0rd" -Vault DeployR

In that example the secret named DellBIOSPassword was set to P@ssw0rd

It's best to always use -Vault DeployR in the command line incase other vaults are ever created on the server.

Retrieve Secret

Testing from Windows, connect to the DeployR server via PowerShell, and run the Get-Secret command

Get-Secret -Name "DellBIOSPassword" | ConvertFrom-SecureString  -AsPlainText

When running in a task sequence, adding something similar to this in your PowerShell script will pull the secret into a variable.

try {
    $SecretBIOSPassword = Get-Secret -Vault DeployR -Name "DellBIOSPassword" | ConvertFrom-SecureString -AsPlainText -ErrorAction Stop
}
catch {
    Write-Warning "DellBIOSPassword secret not found. Checking task sequence environment variable fallback."
}

Console Example: