How to Manage Credentials Securely Using PowerShell SecretManagement and SecretStore in Windows 11

Automating administrative tasks, cloud deployments, and maintenance scripts in Windows 11 frequently requires authentication tokens, API keys, database connection strings, and administrative credentials. Historically, administrators resorted to risky practices—such as hardcoding plain-text passwords into script files, relying on poorly secured configuration files, or managing machine-specific Windows Credential Manager entries through cumbersome Windows APIs. Microsoft modernised credential hygiene across PowerShell with two dedicated modules: Microsoft.PowerShell.SecretManagement and Microsoft.PowerShell.SecretStore. Together, they establish a unified, cross-platform abstraction layer that encrypts sensitive secrets at rest using the local user’s DPAPI cryptographic keys.

Understanding SecretManagement and Extension Vaults

The SecretManagement framework operates across an extensible, decoupled architecture:

• SecretManagement: The core abstraction engine that provides standardised cmdlets (such as Get-Secret, Set-Secret, and Unlock-SecretVault). Scripts interact exclusively with these universal commands regardless of where secrets physically reside.
• Extension Vaults: Backend provider plugins that interface with specific storage technologies. While extension vaults exist for enterprise cloud providers (such as Azure Key Vault or HashiCorp Vault), SecretStore is the native, local, file-based vault that encrypts secrets directly on the local machine using .NET Cryptography APIs.

Installing the Required PowerShell Modules

Both modules are published in the official PowerShell Gallery and can be installed via an elevated console:

1. Open an elevated PowerShell prompt (Run as administrator).
2. Install the SecretManagement core module and the SecretStore extension vault:

Install-Module -Name Microsoft.PowerShell.SecretManagement -Repository PSGallery -Force
Install-Module -Name Microsoft.PowerShell.SecretStore -Repository PSGallery -Force

Registering and Configuring the Local SecretStore Vault

Once installed, register the local SecretStore as your default extension vault:

Register-SecretVault -Name LocalVault -ModuleName Microsoft.PowerShell.SecretStore -DefaultVault

To verify that the vault registered successfully, run Get-SecretVault. Next, configure vault password prompting and idle timeouts:

Set-SecretStoreConfiguration -Scope CurrentUser -PasswordTimeout 900 -Confirm:$false

• -PasswordTimeout 900: Keeps the vault unlocked in memory for 15 minutes (900 seconds) after the initial password prompt, preventing repeated authentication prompts during batch administrative scripts.
• For non-interactive unattended automation tasks (such as scheduled tasks running under a service account), you can configure passwordless unlocking secured strictly by user-context DPAPI:

  Set-SecretStoreConfiguration -Scope CurrentUser -Authentication None -Interaction None -Confirm:$false

Adding, Retrieving, and Managing Secrets

You can store diverse data types including strings, byte arrays, hashtables, and native PSCredential objects:

• Storing an API Token or Secret String:

  Set-Secret -Name "ProductionAPIKey" -Secret "sk_live_98457209384729384"

• Storing a Full PSCredential Object:

  $cred = Get-Credential
  Set-Secret -Name "DomainAdminUser" -Secret $cred

• Retrieving Secrets in Automated Scripts:

  $apiKey = Get-Secret -Name "ProductionAPIKey" -AsPlainText
  $adminCred = Get-Secret -Name "DomainAdminUser"

When retrieving sensitive credentials, Get-Secret returns secure strings by default. Adding the -AsPlainText parameter outputs a decrypted string only when strictly necessary for external REST API headers.

Auditing Vault Contents and Deleting Stale Secrets

To inspect metadata for all stored secrets without exposing their underlying plain-text values:

Get-SecretInfo

The output displays the secret name, data type (e.g., SecureString, PSCredential), and originating vault. To remove an expired secret:

Remove-Secret -Name "ProductionAPIKey"

By migrating administrative scripts to SecretManagement, development and operations teams eliminate hardcoded passwords, ensuring that automation code committed to version control repositories remains completely free of embedded credentials.