Actually, it was dead-simple,
The parameter GuestCredential is allowed to be empty when passing it to Invoke-VMScript, I was wrongly assuming it had to have a value..
function Test-VMCredentials{
[CmdletBinding()]
param(
[Parameter(Mandatory=$true,ValueFromPipeline=$true,Position=0)]
[VMware.VimAutomation.ViCore.Types.V1.Inventory.VirtualMachine]
$VM,
[Parameter(Mandatory=$false,Position=1)]
[PSCredential]
$Credentials
)
$output = Invoke-VMScript -ScriptText "dir c:\" -VM $VM -GuestCredential $Credentials -ScriptType Bat
}
If a credential is supplied (for workgroup-connected servers etc.) that would be used. if its not supplied (to the Test-VMScript-function), I won't get an error from Invoke-VMScript but the cmdlet will instead switch to SSPI since $Credentials is empty.