Viewing a user or computer issued certificate in Active Directory DB

[rezaalikhani]

Hi all;

Does anyone know where the user's or computer's certificate stores in Active Directory database and how we can see them?

Thanks

[Arne Bier]

Have you tried an LDAP browser to inspect such an account which has a cert?  I'd assume it could be a long string with the cert encoded in BASE64 ?

[TomArner]

1 . How do I view user certificates in Active Directory? You can go to your Domain Controller and find the Cert Publishers group in Active Directory. It should have your servers with the Certificate Authority role. If you run the Certutil cmd there, you can get the info of the certificates installed
2 . Where are computer certificates stored in Active Directory? All certificate templates available in AD, regardless if they are published on an enterprise CA or not, are stored in the Certificate Templates container. If an enterprise CA publishes a certificate template, the value is written as an attribute on the CA object 

3 .  Where are user certificates (machine certs)  stored? The certificate store is located in the registry under HKEY_LOCAL_MACHINE root. Current user certificate store: This certificate store is local to a user account on the computer. This certificate store is located in the registry under the HKEY_CURRENT_USER root.

[rezaalikhani]

Found the solution:

This tab appears when you select "Advanced Features" option in the dsa.msc console.

Thanks