Getting certificates details using Invoke-Command powershell gives error

Question

Getting certificates details using Invoke-Command powershell gives error

Sam White 26

Invoke-command -computername server1 -ScriptBlock { dir cert: -Recurse | Where-Object { $_Subject -like 'server1' }}

Gives error The system cannot open the device or file specified. Please help on how to this.

Sam White 26 Reputation points

2024-06-10T14:07:38.9433333+00:00

It is asterisk before and after server1 inside where-object
Rich Matheisen 48,026 Reputation points

2024-06-10T15:10:23.0666667+00:00

Do you have the exception that caused that error? Is it an "accessDenied" error, a "DriveNotFound" error, or some other error?

Also, check to see what permissions are on the registry key Computer\HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\UserDS on "server1".

Can you log on to "server1" using your credentials and run the "dir CERT: -Recurse" cmdlet?

1 answer

Your answer

Sam White 26 Reputation points

2024-06-10T14:07:38.9433333+00:00

It is asterisk before and after server1 inside where-object
Rich Matheisen 48,026 Reputation points

2024-06-10T15:10:23.0666667+00:00

Do you have the exception that caused that error? Is it an "accessDenied" error, a "DriveNotFound" error, or some other error?

Also, check to see what permissions are on the registry key Computer\HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\UserDS on "server1".

Can you log on to "server1" using your credentials and run the "dir CERT: -Recurse" cmdlet?

Answer 1

Michael Taylor 61,116

You are missing a dot between the object and Subject. You should confirm this command runs locally in PS before adding it to the script block to ensure the command is correct.

Invoke-command -computername server1 -ScriptBlock { dir cert: -Recurse | Where-Object { $_.Subject -like '*server1*' }}

For the comparison itself like is a pattern so if you want to find any value with the string in it then you need to wrap it in wildcards (*). Alternatively you can use match which uses regular expression. In this case something like -match 'server1' produces the same results because RE matching will look for any string that contains the given value.

Sam White 26 Reputation points

2024-06-11T13:48:59.1233333+00:00

$_.Subject is what I am using. It was a typo earlier. The exception is System.Component.Model.Win32Exception, Microsoft.Powershell.Commands.GetChilditemcommand I see some others users having similar issues: https://stackoverflow.com/questions/57116536/powershell-fails-when-trying-to-read-certificate-store-with-the-specified-netwo

The command works when not using Invoke-Command but gives this error when using Invoke-Command
Michael Taylor 61,116 Reputation points

2024-06-11T14:37:29.8733333+00:00

The code works when called from another machine. However be aware that the user running the command may not have access to all the certs and therefore it can fail during enumeration. That is what I suspect you're having an issue with here. For example I suspect you can get the current user's certs but when it tries to look in the machine cert it fails (just a guess where the failure is). If you just need the user's certs then filter to that cert store to avoid the issue.

MotoX80 37,161

Server1 might have some kind of problem. Try another server too.

cls
$sb = {
    $admin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")
    "Running on {0}" -f $env:COMPUTERNAME
    "Your name is {0}" -f  $env:USERNAME 
    "Admin level is {0}" -f  $admin
    $Certs = Get-ChildItem cert: -Recurse 
    "I found {0} certificates." -f $Certs.count
    
    $ServerCerts = $Certs | Where-Object -Property Subject -Like '*root*' 
    "I found {0} root certificates." -f $ServerCerts.count

    $srvr = "*" + $env:COMPUTERNAME + "*"  
    $ServerCerts = $Certs | Where-Object -Property Subject -Like $srvr 
    "I found {0} server name certificates." -f $ServerCerts.count
    ($ServerCerts).Subject
    
}
Invoke-Command -ComputerName server1 -ScriptBlock $sb  
Invoke-Command -ComputerName server2 -ScriptBlock $sb

User's image

Sam White 26 Reputation points

2024-06-12T03:37:18.04+00:00

@MotoX80 , thanks.. let me try it out.. however this is not an issue with the server1 as when I login to server using the same credentials and run the command without using Invoke-command, it does not give me this error. This is only happening when using Invoke-command to remotely execute the command.
MotoX80 37,161 Reputation points

2024-06-12T10:10:58.62+00:00

We forum users have no way of knowing what might be causing the issue. It could be some registry/permission change that someone made, some 3rd party software that someone installed, or something peculiar to the OS/patch level.
Try that script against several servers, even desktops. Let's see if it's just that one machine or if we can narrow it down to something else. That's why I included the admin test in the script. Basically just looking for clues.
MotoX80 37,161 Reputation points

2024-06-13T11:41:25.8+00:00
In the script you can also call certutil to see if that list certificates.

certutil.exe -user -store My

Share via

Getting certificates details using Invoke-Command powershell gives error

1 answer

Your answer