Saving credentials for reuse by powershell and error ConvertTo-SecureString : Key not valid for use in specified state

You have to create the password string on the same computer and with the same login that you will use to run it.

ConvertFrom-SecureString takes a Key ( and SecureKey) parameter. You can specify the key to save the encrypted standard string and then use the key again in ConvertTo-SecureString to get back the secure string, irrespective of the user account.

http://technet.microsoft.com/en-us/library/dd315356.aspx

In a project, I have implemented asymmetric encryption, whereby people encrypt the password using the public key and the automation process has the private key to decrypt passwords: Handling passwords in production config for automated deployment

The below will allow credentials to be saved as a file, then those credentials to be used by another script being run by a different user, remotely.

The code was taken from a great article produced by David Lee, with only some minor adjustments from myself https://blog.kloud.com.au/2016/04/21/using-saved-credentials-securely-in-powershell-scripts/

First step is to save a a secure password to a file using AES. The below will run as a stand alone script:

            # Prompt you to enter the username and password            $credObject = Get-Credential            # The credObject now holds the password in a ‘securestring’ format            $passwordSecureString = $credObject.password            # Define a location to store the AESKey            $AESKeyFilePath = “aeskey.txt”            # Define a location to store the file that hosts the encrypted password            $credentialFilePath = “credpassword.txt”            # Generate a random AES Encryption Key.            $AESKey = New-Object Byte[] 32            [Security.Cryptography.RNGCryptoServiceProvider]::Create().GetBytes($AESKey)            # Store the AESKey into a file. This file should be protected! (e.g. ACL on the file to allow only select people to read)            Set-Content $AESKeyFilePath $AESKey # Any existing AES Key file will be overwritten            $password = $passwordSecureString | ConvertFrom-SecureString -Key $AESKey            Add-Content $credentialFilePath $password

Then in your script where you need to use credentials use the following:

            #set up path and user variables            $AESKeyFilePath = “aeskey.txt” # location of the AESKey                            $SecurePwdFilePath = “credpassword.txt” # location of the file that hosts the encrypted password                            $userUPN = "domain\userName" # User account login             #use key and password to create local secure password            $AESKey = Get-Content -Path $AESKeyFilePath             $pwdTxt = Get-Content -Path $SecurePwdFilePath            $securePass = $pwdTxt | ConvertTo-SecureString -Key $AESKey            #crete a new psCredential object with required username and password            $adminCreds = New-Object System.Management.Automation.PSCredential($userUPN, $securePass)            #use the $adminCreds for some task            some-Task-that-needs-credentials -Credential $adminCreds

Please be aware that if the user can get access to the password file and the key file, they can decrypt the password for the user.