Solved

Can PowerShell read the Personal Store for certificate expiration dates?

Posted on 2009-07-07
3
1,986 Views
Last Modified: 2012-05-07
I'm looking for a PowerShell script that can access the Personal store on a Windows Server and alert on Certs about to expire.

Specifically: When the cert is going to expire in 15 days, write an event to the Application log.

Thanks,
Tom
0
Comment
Question by:martit01
3 Comments
 
LVL 70

Expert Comment

by:Chris Dent
ID: 24801879

Hey,

That shouldn't be too tricky actually...

Can you see if this gives you the right certificates?

Get-ChildItem cert:\LocalMachine\My

If it does, all we need to do is filter on the "NotAfter" field and post the results to the event log, neither of which is particularly hard either.

Chris
0
 

Author Comment

by:martit01
ID: 24809457
I ran the cmdlet and got the below output....

Thumbprint                                                                          Subject
----------                                                                               -------
A3E3AE944D46CA0EBA599F148B23D40A33E183BF           CN=la-scomrms02.XXX.com

I don't see any expiration date. Was it suppose to show the expiration date?

Thanks,
Tom
0
 
LVL 5

Accepted Solution

by:
AbqBill earned 500 total points
ID: 24830945
Hi Tom, the X509Certificate2 object has a GetExpirationDateString() method that returns a string representation of the certificate's expiration date. Bill.
$certs = get-childitem cert:\LocalMachine\CA
 

$certs | foreach-object {

  $output = new-object PSObject

  $output | add-member NoteProperty -name Subject -value $_.Subject

  $output | add-member NoteProperty -name ExpirationDate -value $_.GetExpirationDateString()

  $output

}

Open in new window

0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

This script checks a path to see if a folder exists. If the folder does exist you will get output "The folder has previously been created. No action taken" If not it will create the folder. Then adds one user modify permission to the folder. It …
Active Directory replication delay is the cause to many problems.  Here is a super easy script to force Active Directory replication to all sites with by using an elevated PowerShell command prompt, and a tool to verify your changes.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

24 Experts available now in Live!

Get 1:1 Help Now