Verify if the certificate exists on a client system manually:
Run
cmd and execute a query to the registry with the following commands:
reg query HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E
reg query HKLM\SOFTWARE\Microsoft\SystemCertificates\root\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E
NOTE: On Server 2016, the command changes when implemented via a Group Policy (GPO). Another 'Policies' folder is added to the string, as seen below:
reg query HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\root\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E
If you have this issue, you see the following as a result:
Or
The certificate can be in the
\Microsoft\SystemCertificates\root\Certificates\ or
Microsoft\SystemCertificates\AuthRoot\Certificates\ location. You also can view the certificate from
CertManager. As long as the cert is available in any of the above paths, it doesn't cause an issue to the cert store.
Verify if the certificate exists on a client system using ePO:
To verify the presence of the root certificate on a larger number of Windows systems, we created an
EEDK package. You can deploy this package through ePO to look for the presence of the certificate in the system's trust store. It then reports the results back to ePO in the TA custom properties of the system. The default custom property is custom property 8. But, you can change the value of the property when you create the deployment task. After the package deploys to a group of systems, you can create a query or filter the system tree for systems based on the results.
To use this package, follow the instructions below:
- Download the EEDK package CHCKCERT1100.zip from the "Attachments" section of this article.
- Check in the CHCKCERT1100.zip package to your ePO Master Repository.
- Create a Product Deployment Task and select the package Check for Root Certificate for deployment. To specify the custom property that this package reports to, you can add a single number 1–8 in the command-line parameters for the client task.
- Assign the client task to any systems for which you would like to verify the presence of the root certificate.
- After a system has executed the script, one of two results is reported back to custom property 8 or the custom property that you select:
- OLD_CERT - The new certificate is not present on the system.
- NEW_CERT - The new certificate is present on the system.
