Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to create a script to completely automate joining the domain to use during a wds image deployment. I don't want to use the WAIK option because the password is stored in plain text in the xml file. So I've found some powershell scripts online that look like they could work.

This is the command I used to create my encrypted file which contains the password.

read-host -assecurestring | convertfrom-securestring | out-file C:\securestring.txt

Here's the script I'm using.

$domain = "MYDOMAIN.COM"
$password = cat C:\securestring.txt | ConvertTo-SecureString -Force
$username = "$domain\MYUSERNAME"
$credential = New-Object System.Management.Automation.PSCredential($username,$password)
Add-Computer -DomainName $domain -Credential $credential

Here's the error I'm getting.

Windows PowerShell
Copyright (C) 2009 Microsoft Corporation. All rights reserved.

PS C:\> $domain = "MYDOMAIN.COM"
PS C:\> $password = cat C:\securestring.txt | ConvertTo-Secure
String -Force
ConvertTo-SecureString : Cannot process argument because the value of argument
"input" is invalid. Change the value of the "input" argument and run the operat
ion again.
At line:1 char:66
+ $password = cat C:\securestring.txt | ConvertTo-SecureString <<<<  -Force
+ CategoryInfo          : InvalidArgument: (:) [ConvertTo-SecureString], P
+ FullyQualifiedErrorId : ImportSecureString_InvalidArgument,Microsoft.Pow

share|improve this question

migrated from Jun 4 '13 at 14:25

This question came from our site for professional and enthusiast programmers.

That works for local accounts, but not for the password field for joining the domain. – Brum Jun 3 '13 at 17:28
if someone really wants your pwd I don't believe(as far as i know) that secure-string would help much. You can encrypt it using a key, but the ps1 script has to be readable for everyone which makes the location of the key or the key itself + the pwd-dump available for everyone. Poeple who really wants the password would just need to run the same cmd as you have in the ps1 script – Frode F. Jun 3 '13 at 17:41
I've seen similar errors with ConvertTo-Csv if there are certain kinds of errors with the content of the input file, such as trailing blanks. Sure enough, if you take a valid file created by piping a secure string to ConvertFrom-SecureString and add a space at the end, that reproduces the error you're getting. Try re-creating securestring.txt. If you still get the same error, try entering something like "test123" instead of your password. While that won't make your script work, it will help determine if there's some problem with the characters in your password or if it's something else. – Adi Inbar Jun 3 '13 at 21:46
Another thought - maybe you have some default character encoding set that ConvertTo-SecureString doesn't like? Try this command to create your password file: read-host -assecurestring | convertfrom-securestring | out-file C:\securestring.txt -encoding ascii – Adi Inbar Jun 3 '13 at 21:51

Secure strings only work for the user that created them. If you are creating C:\securestring.txt as one user and then trying to read it with a different user it won't work. Try creating the file with the same user that is going to read it.

share|improve this answer
If that were the issue, it would throw a "key not valid" error. I think it has something to do with the formatting of the file. – Adi Inbar Jun 3 '13 at 21:48
I tried your script to create a new securestring.txt file and when running the same script as before I get the following error. ConvertTo-SecureString : Key not valid for use in specified state. At line:1 char:61 + $password = cat C:\securestring.txt | ConvertTo-SecureString <<<< -Force + CategoryInfo : InvalidArgument: (:) [ConvertTo-SecureString], CryptographicException + FullyQualifiedErrorId : ImportSecureString_InvalidArgument_CryptographicError,Microsoft.PowerShell.Comma‌​nds.ConvertToSecureStringCommand – Brum Jun 4 '13 at 19:45

Instead of using a text file to store your password, why don't you ask for a user input. It's never advisable to store Domain Admin passwords in Text files. You might as well, not even bother with the Txt file and just declare the password directly in the script.

Example 1: Requesting user to input the password

$domain = "MYDOMAIN.COM" 
$password = Read-Host -Prompt "Enter password for $user" -AsSecureString
$username = "$domain\MYUSERNAME"
$credential = New-Object System.Management.Automation.PSCredential($username,$password)
Add-Computer -DomainName $domain -Credential $credential

Example 2: Declare the password instead of point to a text file

$domain = "myDomain"
$password = "Pa$$w0rd123" | ConvertTo-SecureString -asPlainText -Force
$username = "$domain\myUserAccount" 
$credential = New-Object System.Management.Automation.PSCredential($username,$password)
Add-Computer -DomainName $domain -Credential $credential
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.