Archive for January, 2012

Copy certificates from one server to another

So for some reason, which until now remains a mystery, certificates where missing in the Trusted root certificate authorities certificate store on one of our servers.

Of course one of the missing ones, was the one needed for a main part of the servers purpose, so that had to be fixed.

While the certificates mmc does permit the export on the source server and the import onto the broken one, working in the GUI, is just….

So I cooked up a Powershell script to do the job for me:

Compares a given certificate store between 2 Windows machines. Copies missing to target if specified

The script compares the specified certificate store of the source machine against the target machine. 
If the Write switch is specified, the missing certificates are copied from the source machine to the target machine

.PARAMETER SourceServer
Source Machine name

.PARAMETER TargetServer
Target Machine name

Certificate store to be checked
Possible values of the store: 
My - Personal Store
Root - Trusted root certificate authorities
CertificateAuthority - Intermediate certificate authorities
AuthRoot - Third-party certificate authorities

If specified, certificates missing on the target server will be copied to the target server


Console output

Check-MachineCerts.ps1 -SourceServer "SomeServer" -TargetServer "SomeServer" -certstore "AuthStore"
Outputs the certificates missing in the Third-party certificate authorities store on the target machine as compared to the source machine

Check-MachineCerts.ps1 -SourceServer "SomeServer" -TargetServer "SomeServer" -certstore "My" -write
Outputs the certificates missing in the Personal Store on the target machine as compared to the source machine. 
Copies the missing certificates to the target machine

by theAdminGuy -
#Connect to the source Root store (readonly)
$sourceStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("\\$SourceServer\$CertStore","LocalMachine")
#connect to the target store (readwrite)
$targetStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("\\$TargetServer\$CertStore","LocalMachine")

$sourceCerts = $sourceStore.certificates
$targetCerts = $targetStore.certificates

Function CheckPrecense(){
	[int]$intCertFound = "0"
    $script:rtrCheckPrecense = "CertNotFound"
    ForEach ($targetcert in $targetCerts){     
        $test = $sourcecert.Equals($targetcert)
        if ($test -eq $true){
    If ($intCertFound -ne "0"){
            $script:rtrCheckPrecense = "CertFound"
} #end function 

foreach ($sourcecert in $sourceCerts){
    CheckPrecense $sourcecert
    If ($rtrCheckPrecense -eq "CertNotFound"){
        Write-Host `n`n $sourceCert.Subject " was not found on " $TargetServer
        If ($write -eq $true){
        	Write-Host `n "Copying Certificate from " $SourceServer `n

Don’t judge me by the fact that the .Synopsis part of the script takes up half the lines in the script, but not being a programmer by trade, I am trying to improve on my documentation skills (as well as making myself able to reuse the script once I have forgotten it’s original purpose)

The script can be easily modified to also remove certs from the target, which is not present on the source.

Do let me know all your input, thoughts etc.



Powershell One-Liners – Process Monitor

As a server admin, I often face a situation where I have to perform an action on the server, but some process is running, and I have to wait.

Rather than sitting around checking the server every 5 minutes, I set a Powershell one-liner monitor with notification:

powershell.exe -command "& {if (! (get-process -name TheService -erroraction SilentlyContinue)){Send-MailMessage -SmtpServer 'theSMTPServer.void.null' -from -To 'theadmin@void.null -Subject 'TheService is not running, check theServer'}}"

I simply add the above line same as in the Folder cleaner


%d bloggers like this: