Start-Job with credential in custom task problems

Question

I am trying to develop a custom task using Powershell which needs to use Start-Job -Cred to switch to another user in places. Agent is running as user A and I need to switch to user B. Logging in to the server running the agent as user A and then running the script works fine - the Start-Job switches credentials and runs a scriptblock as user B.

Running exactly the same thing from VSTS in the cloud using the same (on-prem) agent server running the agent as user A fails with the uninformative error:

"The background process reported an error with the following message: ."

I have done more debugging and there is no other error message anywhere. It seems to be related to the -Cred parameter of Start-Job as it makes no difference what is in the script block run and if I remove the -Cred parameter, it's also fine.

• User A is in the Adminstrators group on the server running the agent
• Agent runs as user A

Any ideas?

Answer 1

Try it with Invoke-Command, for example (output current user name):

$mypwd = ConvertTo-SecureString -String "[password, could use variable]" -Force -AsPlainText
$Cred = New-Object System.Management.Automation.PSCredential('[user name]',$mypwd)
$scriptToExecute = 
{
$VerbosePreference='Continue'
Write-Output "$env:UserName"
# Write-Verbose "Verbose" 4>&1
}
$b = Invoke-Command -ComputerName localhost -ScriptBlock $scriptToExecute -Credential $Cred
Write-Output "Content of variable B"
Write-Host $b

Answer 2

Based on your experiences, your credentials are not being passed properly. Try this method and insert it into your script:

Outside of your script, get the securestring object-

Read-Host -AsSecureString | ConvertFrom-SecureString

Take the output of this command (where you enter the password), and put it before your start-job-

$Secure = ConvertTo-SecureString -String 'above output'
$Cred = New-Object System.Management.Automation.PSCredential('Username',$Secure)
Start-Job -Credential $Cred

The SecureString can be reversed by someone with know-how, but if the script and/or account is secure, then that doesn't matter.