Windows服务运行PowerShell脚本时无法读取加密vSphere凭据的解决方法咨询

我用PowerShell的ConvertFrom-SecureString把vSphere环境的凭据保存到了文本文件里，原本打算在脚本里用下面的命令读取：

$password4host = get-content C:\shutdown\HostsCred.txt | convertto-securestring

但当我通过Windows服务执行这个脚本时，却报错说无法从文本文件读取凭据。查了一下原因，好像是用ConvertFrom-SecureString加密的字符串是和保存它的用户绑定的，只有那个用户自己才能解密。

我的脚本代码片段 #

$time = ( get-date ).ToString('HH-mm-ss')
$date = ( get-date ).ToString('dd-MM-yyyy')
$logfile = New-Item -type file "C:\shutdown\ShutdownLog-$date-$time.txt" -Force

Import-Module -Name VMware.*

# Some variables
$vcenter = "10.10.10.10"
$username = "fakeuser@vsphere.local"
$username4host = "fakeuser"
$cluster = "ESXi-Cluster"
$datacenter = "Datacenter"
$vCenterVMName = "VMware vCenter Server" #Name of vCenter VM
$StarWindVM1 = "Starwind-VM" #Name of first StarWind VM
$StarWindVM2 = "Starwind-VM (1)" #Name of second StarWind VM
$StarWind = "10.10.10.11" #IP address of one of StarWind VMs
$ESXIhost1 = "10.10.10.12" #Name of first ESXI Host
$ESXIhost2 = "10.10.10.13" #Name of second ESXI Host

try
{
$password4vCenter = get-content C:\shutdown\vCenterCred.txt | convertto-securestring
}
catch
{
Write-Host $_ -foreground red
Add-Content $logfile "$(get-date -f dd/MM/yyyy) $(get-date -f HH:mm:ss) $_"
exit
}

try
{
$password4host = get-content C:\shutdown\vCenterCred.txt | convertto-securestring
}
catch
{
Write-Host $_ -foreground red
Add-Content $logfile "$(get-date -f dd/MM/yyyy) $(get-date -f HH:mm:ss) $_"
exit
}

$tmp = get-content C:\Temp\HostsCred.txt | convertto-securestring
$password4Starwind = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($tmp))

$credentials = new-object System.Management.Automation.PSCredential $username, $password4vCenter
$credentials4host = new-object System.Management.Automation.PSCredential $username4host, $password4host

Write-Host ""
Write-Host "$(get-date -f dd/MM/yyyy) $(get-date -f HH:mm:ss) Shutdown command has been sent to the vCenter Server." -Foregroundcolor yellow
Write-Host "This script will shutdown all of the VMs and hosts located in $datacenter." -Foregroundcolor yellow
Write-Host ""
Sleep 5

Add-Content $logfile "$(get-date -f dd/MM/yyyy) $(get-date -f HH:mm:ss) PowerOff Script Engaged"
Add-Content $logfile ""

# Connect to vCenter
$counter = 0
if ($counter -eq 0){
Set-PowerCLIConfiguration -InvalidCertificateAction ignore -Confirm:$false | Out-Null
}

Write-Host "Connecting to vCenter - $vcenter.... " -nonewline
Set-PowerCLIConfiguration -InvalidCertificateAction ignore -confirm:$false
Add-Content $logfile "$(get-date -f dd/MM/yyyy) $(get-date -f HH:mm:ss) Connecting to vCenter - $vcenter"

try
{
$success = Connect-VIServer $vcenter -Credential $credentials -WarningAction:SilentlyContinue
}
catch
{
Write-Host $_ -foreground red
Add-Content $logfile "$(get-date -f dd/MM/yyyy) $(get-date -f HH:mm:ss) $_"
exit
}

我遇到的问题和尝试的解决方法 #

我已经把这个Windows服务的登录用户改成了当初加密凭据的那个用户，但服务还是没法正常读取凭据——要么是服务没有以指定用户身份运行，要么就是这种加密字符串本来就没法在Windows服务里用？

奇怪的是，当我用那个用户登录系统，直接在PowerShell ISE里运行脚本的时候，完全没有任何错误，一切正常。

现在我想请教的是：怎么才能在Windows服务触发的PowerShell脚本里使用凭据，又不用把明文密码写在脚本里？

备注：内容来源于stack exchange，提问作者TheWhiteJoker