Receiving Event ID 64

Computer Gladiator 441 Reputation points
2021-02-22T17:25:23.83+00:00

Hello, we have a Windows Server 2012 R2 as a domain controller and we receive several event id 64 messages.... Certificate for local system with Thumbprint "xx....xx" is about to expire or already expired.
This has been appearing for sevarl months and does not appear to be affecting anything. I understand that this can be ignored but wanted to clean this up. These thumbprints do not seem to appear in the Certificates MMC program. How can I find them and remove?
Thank you

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,121 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,720 questions
Accepted answer
  1. Daisy Zhou 18,701 Reputation points Microsoft Vendor
    2021-02-23T01:39:15.983+00:00

    Hello @Computer Gladiator ,

    Thank you for posting here.

    From the error message you provided, it seems some cert in user store or computer store is about to expire or already expired. We can try to find it as below.

    1.Click Start, type mmc, and then press ENTER.
    2.If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
    3.On the File menu, click Add/Remove Snap-in, click Certificates, and then click Add.** **
    4.Select the user or computer account that logged the error, and click Next.
    5.Click Finish, and then click OK.
    6.In the console tree, click Certificates - Current User or Certificates (Local Computer), and then click Personal.
    7.In the console tree, double-click Certificates, double-click Personal, and then click Certificates.
    8.Locate the certificate with the thumbprint listed in the event log message.

    For example:

    70799-thr.png

    Hope the information above is helpful.

    Should you have any question or concern, please feel free to let us know.

    Best Regards,
    Daisy Zhou

    1 person found this answer helpful.

3 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. ESP IT Guy 26 Reputation points
    2023-01-25T22:03:06.56+00:00

    Firstly, why do MS people insist on using the snap-in for certs? Just hit start and type Cert, gives the option of Computer and User certs.

    Secondly, to find a cert via thumbprint use powershell:

    Get-ChildItem -path 'Cert:\*5b1fd0c0be45f22c868048f08939a132d532b11f' -Recurse | Format-List

    4 people found this answer helpful.
  2. Computer Gladiator 106 Reputation points
    2022-05-03T15:31:57.787+00:00

    Hello, how can I tell if this can be removed or should it be renewed?

    1 person found this answer helpful.
    0 comments
  3. Computer Gladiator 106 Reputation points
    2023-05-08T21:02:33.9+00:00

    I typically would use the snap-in tool to confirm which one is expired. Match it up with the event log notification then determine whether I wish to remove or renew it. Hope this helps

    0 comments