AD Authentication and credentials encryption

Question

Hello,
I need to authenticate to Active Directory using different credentials through the System.DirectoryServices.DirectoryEntry in a PowerShell-script. Security is a huge deal in the environment I'm working in, and I have not been able to find a clear answer on
this.
As the DirectoryEntry.AuthenticationType documentation says, since .NET Framework 2.0, the default AuthenticationType is "Secure". Now, apparently using the Secure AuthenticationType in a AD context means the following: "Active Directory Domain
Services uses Kerberos, and possibly NTLM, to authenticate the client." What I need to make sure of is that the credentials are not passed in clear-text over the network. Is it sufficient to rely on the Secure authentication type or should I specify additional
AuthenticationTypes, in which case what would be the most secure combination?
Additionally to this, another security concern would be that the password would be stored in local memory until the next time the .NET garbage collection takes place, since there is no native method of disposing System.String. Can I use the System.GC.Collect-method
to remove the clear-text passwords from memory? I've read that this is not good practice as it can potentially cause performance issues, but looking at this from a security-perspective, it may be worth looking into anyways if it can remove the string from
memory.
I am not sure if this is the right forum to ask these kind of questions, but figured it would be worth a shot.
Thanks,
Andreas

Answer 1

It's better to never store the password as a string at all (never mind the fact that it's sitting in a plain text PowerShell script file.)  For example, using a character array allows you to zero out the memory whenever you like:
# The characters of "SecretPassword", obtained with the command:
# [int[]]"SecretPassword".ToCharArray() -join ', '
$chars = [char[]](83, 101, 99, 114, 101, 116, 80, 97, 115, 115, 119, 111, 114, 100)
$securePassword = New-Object securestring
foreach($char in $chars)
$securePassword.AppendChar($char)
$securePassword.MakeReadOnly()
[Array]::Clear($chars, 0, $chars.Count)
This is better than relying on the garbage collector for strings, which would simply make the string's memory available again (without zeroing it out), but it's still not perfect.  The CLR may have moved the character array around before it was zero'ed,
leaving older copies of it around
Best is to not hard-code the password at all, in any form.  Read it from secure storage somewhere directly into a SecureString (such as by using the ConvertTo-SecureString / ConvertFrom-SecureSting cmdlets without the -AsPlainText switch; this encrypts
the data using DPAPI by default.)