PowerShell DSC Credential Decryption Error -

i have created pull server configuration. pull server, being used compile mof files , client both windows server 2016, updated azure image.

i kept getting errors when passing in credentials. therefore wrote tiny custom dsc resource displays password clear txt when run start-dscconfiguration -wait -verbose

you can find here: https://gist.github.com/aboersch/65e846a4966fe2c4708ed21d655a54a7

the client not correctly decrypt credentials. password receiving

-----begin cms----- <long multi-line base64 string> -----end cms----- 

if pass unprotect-cmsmessage receive correct password.

the certificate passes $.privatekey.keyexchangealgorithm , $.verify

i have tried changing certificate provider to'"microsoft enhanced cryptographic provider v1.0"', '"legacy cryptographic service provider"', , '"microsoft rsa schannel cryptographic provider"'.

i have tried xdscutils new-xselfsigneddscencryptioncertificate.

if use same certificates , compile , execute on same server there no problems.

i have tried these: dsc problems credentials , build 10586 https://wespoint.wordpress.com/2017/01/19/powershell-dsc-encryption-issue/

here cert properties:

enhancedkeyusagelist     : {client authentication (1.3.6.1.5.5.7.3.2), server authentication (1.3.6.1.5.5.7.3.1)} dnsnamelist              : {computerfqdn} sendastrustedissuer      : false archived                 : false enhancedkeyusage         : document encryption (1.3.6.1.4.1.311.80.1) friendlyname             :  issuername               :  notafter                 : 4/14/2018 1:09:37 pm notbefore                : 4/14/2017 1:09:37 pm hasprivatekey            : true privatekey               :  publickey                : rsa (2048 bits) rawdata                  :  serialnumber             : 19000000115fcb3c2e4c71ba69000000000011 subjectname              :  signaturealgorithm       : sha256rsa thumbprint               : f4238e74bfb238dee89c78c13b5c2c8182674801 version                  : 3 handle                   : 1362382910512 issuer                   : ca subject                  : cn=computerfqdn 

the problem related partial configurations , believe genuine bug in wmf 5.1 on windows server 2016.

essentially if have partial configurations (push or pull doesn't matter), , 1 of configuration functions not contain resource has credential, forcing credential serialised using certificate mof, decryption fail.

you can reproduce on windows server 2016 or windows 10 wmf 5.1:

1. add folder called dsctest c:\program files\windowspowershell\modules , add files gist it.

2. execute this script. first 2 pass while last 1 fail.

the workaround include resource (even if dummy one) uses credential every partial configuration function. dsccredentialhole resource in module first gist for.