KeePass is an offline password manager used as a secret vault through the SecretManagement.KeePass extension. Its protected database file can be moved between machines, users, or network shares, making it useful when automations need shared credentials rather than secrets tied to one user and machine. section 4.3.3 section 4.3.4
For unattended automation, create a database without a master password and protect it with a key file instead. Store the database and key file separately: portability also means a copied database may be attacked elsewhere, while a separately protected key file makes that copy unusable. section 4.3.3 section 4.5
Set up KeePass for PowerShell automation by separating access, storage, and registration:
- Install KeePass to create the database file; the extension module itself can access an existing database without KeePass installed. section 4.3.3
- Create a .kdbx database and a key file using expert options, omitting the master password when the vault must run unattended. section 4.3.3
- Install SecretManagement.KeePass and register the vault with its database path, key-file path, and UseMasterPassword set to false. section 4.3.3
- Restrict authorized access to both files through file and share permissions, and never keep them together. section 4.5
Shared SendGrid credentials
A SQL health-check automation can keep SendGrid email credentials in a shared KeePass vault while holding SQL connection secrets in SecretStore. Updating the shared email credential then updates every automation that uses it, while separate vaults limit the effect of a compromise. section 4.3.4
$ModuleName = 'SecretManagement.KeePass'
Register-SecretVault -Name 'SmtpKeePass' -ModuleName $ModuleName -VaultParame
ters @{
Path = " \\ITShare\Automation\SmtpKeePass.kdbx"
UseMasterPassword = $false
KeyPath= "C:\Users\svcacct\SmtpKeePass.keyx"
}
This registration listing shows a vault configured with a network database path, a separately located key file, and no master password for unattended access. section 4.3.3
