Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working with a Powershell script that adds scheduled tasks to systems in our domain. When I run this script, it will prompt me for my password. I sometimes fat finger the password and the process starts, which locks out my account. Is there a way to verify my credentials to make sure that what I typed in will validate with the Domain?

I'd like to find a way to query the Domain controller. I've done some Google searches and I should be able to do a WMI query and trap for an error. I would like to avoid that style of validation if possible.

Any ideas? Thanks in advance.

share|improve this question
up vote 19 down vote accepted

I have this in my library:

$cred = Get-Credential #Read credentials
 $username = $cred.username
 $password = $cred.GetNetworkCredential().password

 # Get current domain using logged-on user's credentials
 $CurrentDomain = "LDAP://" + ([ADSI]"").distinguishedName
 $domain = New-Object System.DirectoryServices.DirectoryEntry($CurrentDomain,$UserName,$Password)

if ($ -eq $null)
 write-host "Authentication failed - please verify your username and password."
 exit #terminate the script.
 write-host "Successfully authenticated with domain $"
share|improve this answer
This is exactly what I am looking for. Thanks! – Doltknuckle Jun 3 '11 at 19:50
If I'm not mistaken, this would end up sending the password in plain text across the network, right? If it does, then am I right in assuming that AccountManagement.PrincipalContext.ValidateCredentials() does not (if you provide a securestring for the password)? – Code Jockey Jul 23 '15 at 19:00

This is what I've used in the past; it's supposed to work for local machine accounts and 'application directory', but so far I've only used it successfully with AD credentials:

    function Test-Credential {
        Takes a PSCredential object and validates it against the domain (or local machine, or ADAM instance).

    .PARAMETER cred
        A PScredential object with the username/password you wish to test. Typically this is generated using the Get-Credential cmdlet. Accepts pipeline input.

    .PARAMETER context
        An optional parameter specifying what type of credential this is. Possible values are 'Domain','Machine',and 'ApplicationDirectory.' The default is 'Domain.'

        A boolean, indicating whether the credentials were successfully validated.

        [string]$context = 'Domain'
    begin {
        Add-Type -assemblyname system.DirectoryServices.accountmanagement
        $DS = New-Object System.DirectoryServices.AccountManagement.PrincipalContext([System.DirectoryServices.AccountManagement.ContextType]::$context) 
    process {
        $DS.ValidateCredentials($credential.UserName, $credential.GetNetworkCredential().password)
share|improve this answer
I'd love to hear if someone notices this - I believe that when I use ValidateCredentials() in this manner with an incorrect password, it seems to trigger two (2) bad password attempts - I can't control the number of attempts threshold on our domain, and it's low, so I'd prefer not to have two bad attempts when I'm making a single call... can anyone see this as well? – Code Jockey Jul 23 '15 at 18:53
Are you using domain\user or UPN (user@domain) format? I'm not in a position to replicate this, but the following URL describes a similar problem:… – jbsmith Jul 27 '15 at 21:36

what I do is something like the following

share|improve this answer
Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Mark Henderson Apr 29 '13 at 22:20

I've found this post useful however it didn't solve my problem as I was trying to run it from a script with the local admin account logged on. It does not seem to work as local admin (only when logged on as a domain user).

However I did finally manage to get a working solution and since it was so much trouble I thought I'd share it here so anyone else with this problem will have the answer right here. Both answers on the one page depending on your needs.

Note that higher up in the scipt (not included here as this is just the get-credentials section) powergui is installed and is a requirement for this code below (as well as the "Add-PSSnapin Quest.ActiveRoles.ADManagement" line). Not sure what powergui does that's different but no one else could tell me and it works.

Subsitute your own domain name in the "domain_name" sections.

#Get credentials
$credential_ok = 0
while ($credential_ok -ne 1)
    $credential = get-credential
    $result = connect-qadservice -service *domain_name* -credential $credential
    [string]$result_string = $result.domain
    if ($result_string -eq "*domain_name*")
        $credential_ok = 1
$username = $credential.username 
$password = $credential.GetNetworkCredential().password 

$date = get-date
Add-Content "c:\lbin\Install_log.txt" "Successfully authenticated XP script as $username $date"
share|improve this answer
Welcome to Server Fault! This is an old question, if it's answers don't help you then please ask your own question by clicking the Ask Question button. – Iain Oct 10 '12 at 10:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.