SCOM RunAs Credential Decryption

SCOM RunAs credential recovery retrieves credentials distributed to a SCOM-managed host or stored in SCOM configuration. On a SCOM server, SCOMDecrypt can retrieve and decrypt RunAs records from the Operations Manager database. On an enrolled agent, SharpSCOM DecryptRunAs can decrypt RunAs credentials stored in the HealthService registry. Where an OpsMgrConnector.Config policy file and its matching local certificate key are available, SharpSCOM DecryptPolicy decrypts the SecureData payload; the resulting Password value can remain Base64 encoded and requires a separate decode. Recovery therefore depends on the applicable server or agent foothold, local privileges, database access, or key access. Exposure is limited to hosts to which the RunAs account was distributed.