Skip to content
Trending
Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface
FIX PowerShell DSC Encrypted PSCredential property Issue

FIX PowerShell DSC Encrypted PSCredential property Issue

Written By Anoop C Nair
Last Updated July 20, 2022
Posted In PowerShell
SHARE

Microsoft has fixed PowerShell DSC Encrypted PSCredential property Issue with June 2022 cumulative update. This PSCredential property issue impacts you if password encryption is in use. This issue is already fixed with the latest CU.

Desired State Configuration (aka DSC) is a management platform in PowerShell that enables administrators to manage IT and development infrastructure with configuration as code. There is another known issue with DSC and WMF 5.0 update and this is explained in the below section.

This encrypted password issue is only applicable for enterprise/education/prof versions of Windows operating systems. This issue is not likely to be experienced by home users of Windows.

Microsoft didn’t release any documentation on this issue with the original release notes of June or July 2022 cumulative updates. It’s interesting to see that this issue is opened on 19th July 2022 and resolved on 12th July 2022.

Patch My PC

July/Aug 2022 Cumulative Update Note-> Print and Scan Failures after Aug 9th Patch Updates On Domain Controllers | Smart Card Authentication.

The issue with PowerShell DSC Encrypted PSCredential property

Let’s check the Issue with PowerShell DSC Encrypted PSCredential property. This issue is impacting all the server and client Windows operating systems. This included Windows 11, Windows 10, Windows Server 2022, 2016, etc.

There were similar issues (SqlSetup: Does not allow null or empty password for MSA) reported back in 2017, etc but I don’t think the known issue with June 2022 Cumulative Updates has anything to do with other issues.

The following is the Error that you receive if you are yet to apply July patches and use an encrypted password for PowerShell DSC implementation. PowerShell Desired State Configuration resources might fail to apply successfully.

“The password supplied to the Desired State Configuration resource <resource name> is not valid. The password cannot be null or empty.”

Fixed PowerShell DSC Encrypted PSCredential property Issue 1
Fixed PowerShell DSC Encrypted PSCredential property Issue 1

I have also seen another DSC encrypted password issue with WMF 5.0 RTM updates. The Certificates used to encrypt/decrypt passwords in DSC configurations may not work after installing WMF 5.0 RTM. Microsoft already provided a workaround for this issue as well.

FIX Encrypted the PSCredential property with DSC Issue

As per Microsoft documentation, the issues with PowerShell DSC Encrypted the PSCredential property are fixed with July 2022 Cumulative Update Patches for different operating systems. You need to install the July Cumulative Updates immediately on the following devices.

  • Windows 10 -> KB5015807 
  • Windows 11 -> KB5015814
  • Server 2022 21H2 -> KB5015827
  • Server 20H2 -> KB5015807

Read More details on July 2022 patches and direct download links from the following post -> Windows 10 KB5015807 Windows 11 KB5015814 July 2022 Patch Tuesday.

Fixed PowerShell DSC Encrypted PSCredential property Issue 2
Fixed PowerShell DSC Encrypted PSCredential property Issue 2

FIX: Certificates used to encrypt/decrypt passwords in DSC configurations

The issue with DSC configuration after WMF 5.0 update is a different issue than the one with the June 2022 Cumulative Update. However, I thought it’s worth mentioning over here so that we can avoid confusion.

Microsoft already provided a fix for WMF 5.0 update issue. You have to re-create the certificate with Data Encipherment or Key Encipherment Key usage, and Document Encryption Enhanced Key usage (1.3.6.1.4.1.311.80.1). All the details are available at Protect-CmsMessage.

DSC PowerShell cmdlets may fail after installing WMF 5.0 RTM with the LCM failed to retrieve the property PendingJobStep from the object of class dscInternalCache. This is also a known issue and the workaround is given below.

Remove-Item -Path $env:SystemRoot\system32\Configuration\DSCEngineCache.mof

Author

Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.

Written by

Anoop C Nair is Workplace Technology solution architect with 25+ years of experience in global enterprise organizations such as JP Morgan, Capgemini, etc. Microsoft Certified Trainer. Microsoft MVP from 2015 onwards for consecutive 11+ years! He also conducts Intune and modern workplace tech training for enterprise organizations. He is Blogger, Speaker, and Founder of HTMD Community and HTMD Conference. His main focus is on Device Management technologies like Intune, Windows, Cloud PC. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Windows, Entra, Microsoft Security.

Discussion

Join the discussion

Your email address will not be published. Required fields are marked *

Related guides

Entra

Microsoft Graph API Automation to Reclaim the Microsoft 365 License of Disabled Users

Key Takeaways Microsoft Graph API Automation to Reclaim the Microsoft 365 License of Disabled Users! This article explains how to automate the process of reclaiming Microsoft 365 licenses from disabled users. License management is a critical aspect of maintaining cost efficiency and compliance in any organisation. Understanding Microsoft 365 Licensing A Microsoft 365 license is […]

SN Sujin Nelladath 6 min read
Intune

Automate the Process of Removing Primary User from Intune Device using Microsoft Graph API

Automate the Process of Removing Primary User from Intune Device using Microsoft Graph API! In this article, we’ll explore how to remove the primary user from an Intune-managed device using its machine name, leveraging Microsoft Graph API and PowerShell scripting. This approach is particularly useful when transitioning devices into shared mode for environments like classrooms, […]

SN Sujin Nelladath 12 min read
Intune

Step-by-Step Guide to Export Intune Platform PowerShell Scripts via Graph API

Let’s learn how to export Intune Platform Windows PowerShell scripts using PowerShell Script and Graph API. This article presents a streamlined and dependable method for retrieving PowerShell scripts from Microsoft Intune using the Graph API. Designed for efficiency and ease of execution, this approach simplifies script management across Windows devices. Driven by a passion for […]

SN Sujin Nelladath 6 min read