topic Re: Viewing a user or computer issued certificate in Active Directory in Network Access Control

Viewing a user or computer issued certificate in Active Directory DB

rezaalikhani — Tue, 10 Sep 2024 19:43:06 GMT

Hi all;

Does anyone know where the user's or computer's certificate stores in Active Directory database and how we can see them?

Thanks

Re: Viewing a user or computer issued certificate in Active Directory

Arne Bier — Wed, 11 Sep 2024 20:44:44 GMT

Have you tried an LDAP browser to inspect such an account which has a cert? I'd assume it could be a long string with the cert encoded in BASE64 ?

Re: Viewing a user or computer issued certificate in Active Directory

TomArner — Wed, 11 Sep 2024 21:01:42 GMT

1 . How do I view user certificates in Active Directory? You can go to your Domain Controller and find the Cert Publishers group in Active Directory. It should have your servers with the Certificate Authority role. If you run the Certutil cmd there, you can get the info of the certificates installed
2 . Where are computer certificates stored in Active Directory? All certificate templates available in AD, regardless if they are published on an enterprise CA or not, are stored in the Certificate Templates container. If an enterprise CA publishes a certificate template, the value is written as an attribute on the CA object

3 . Where are user certificates (machine certs) stored? The certificate store is located in the registry under HKEY_LOCAL_MACHINE root. Current user certificate store: This certificate store is local to a user account on the computer. This certificate store is located in the registry under the HKEY_CURRENT_USER root.

Re: Viewing a user or computer issued certificate in Active Directory

rezaalikhani — Sat, 28 Sep 2024 11:13:05 GMT

Found the solution:

This tab appears when you select "Advanced Features" option in the dsa.msc console.

Thanks