Hi,
the Windows certificates MMC plugin allows to view and edit the most (expect the enterprise store) of the certificates Windows uses. But the location of the certificates is not really transparent.
Here is a list where those certificates resides physically.
Certificates located in the Registry
| Context | Registry Path | Description |
|---|---|---|
| User | HKCU\SOFTWARE\Microsoft\SystemCertificates | Physical store for user specific public keys |
| User | HKCU\SOFTWARE\Policies\Microsoft\SystemCertificates | Physical store for user specific public keys installed by Active Directory (AD) Group Policy Objects (GPOs) |
| Computer | HKLM\SOFTWARE\Microsoft\SystemCertificates | Physical store for machine wide public keys |
| Computer | HKLM\SOFTWARE\Microsoft\Cryptography\Services | Physical store for keys associated with a specific service |
| Computer | HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates | Physical store for machine wide public keys installed by GPOs |
| Computer | HKLM\SOFTWARE\Microsoft\EnterpriseCertificates | Physical store for machine wide public keys installed by the Enterprise PKI Containers within an AD domain |
Certificates located in the Filesystem
| Context | Filepath | Description |
|---|---|---|
| User | %APPDATA%\Microsoft\SystemCertificates | Physical store for user specific public keys and pointers to private keys |
| User | %APPDATA%\Microsoft\Crypto | Physical store for user specific private key containers |
| Computer | %ProgramData%\Microsoft\Crypto | Physical store for machine wide private key containers |
The certificates can be managed by the Powershell CERT PSDrive provider
User certificates
PS D:\> cd Cert:\CurrentUser\my PS Cert:\CurrentUser\my\> Get-Item *
Computer certificates
PS D:\> cd Cert:\LocalMachine\my PS Cert:\LocalMachine\my\> Get-Item *
The enterprise store is not reachable from powershell.
An example to get all certificates from the enterprise ntauth store
PS D:\> Get-ItemProperty HKLM:\SOFTWARE\Microsoft\EnterpriseCertificates\NTAuth\Certificates\* -name blob | %{new-object System.Security.Cryptography.X509Certificates.X509Certificate2($_.Blob,$null)}
Or with certutil
D:\> certutil -store -enterprise ntauth
To get a list of futher powershell command lets
PS D:\> get-command -Module pki
Michael
Advertisment to support michlstechblog.info