Skip to content

Get-DecryptedObject: Refactor related commands#10130

Draft
andreasjordan wants to merge 6 commits intodevelopmentfrom
refactor_Get-DecryptedObject
Draft

Get-DecryptedObject: Refactor related commands#10130
andreasjordan wants to merge 6 commits intodevelopmentfrom
refactor_Get-DecryptedObject

Conversation

@andreasjordan
Copy link
Collaborator

@andreasjordan andreasjordan commented Feb 1, 2026

Get-DecryptedObject needs two things:

  • A Dedicated Admin Connection (DAC) to select master.sys.syslnklgns
  • A WinRM connection to read "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server$serviceInstanceId\Security"

That's why Get-DecryptedObject needs $Credential which it used all the time, but the parametr was missing.

So every command that calls Get-DecryptedObject needs $Credential as well. This is:

  • Copy-DbaCredential
  • Copy-DbaDbMail
  • Copy-DbaLinkedServer
  • Export-DbaCredential
  • Export-DbaLinkedServer

So every command that calls one of those commands needs $Credential as well. This is:

  • Start-DbaMigration
  • Sync-DbaAvailabilityGroup
  • Export-DbaInstance

TODO:

  • Sync-DbaAvailabilityGroup allows pipeline input and works only if the used connection is a dac. A test has to be implemented or we have to remove pipeline support. As Sync-DbaAvailabilityGroup has no test this needs to be tested in my lab.

More problems:

  • The commands that call Get-DecryptedObject open and close a DAC. But if they are called from other commands or from scripts using an already open DAC, then they must noch close this DAC.
  • In Start-DbaMigration, we need a DAC for passwords, but also a non-DAC for Copy-DbaDatabase.

I hope I can solve that nightmare in the next days, but maybe it will take until next weekend.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant