Run `certutil -DCInfo` on a different target domain

Question

It seems that running certutil.exe -DCInfo Verify will check the certificates for all domain controllers in the domain of the logged-in user account.

In our AD forest, we have a handful of domains. I only have a unique account in two of them, but have administrative permissions over all of them.

Is there a way I can run the command to target a different domain than the one I'm logged into, or do I really have to have an account in each one?!

Alternately, is there another way to accomplish the same goal?

score 0 · Accepted Answer · edited May 23 '17 at 11:33

0

certutil works in the user context from which it is called.

It seems unlikely that you will be able to achieve what you want without an account on each domain, unless you can think of a way to impersonate the other users - which would probably require calling into the Win32 API. Here's a SO question which might help you if you decide to go down that route.

edited May 23 '17 at 11:33

Community

1

answered Nov 09 '11 at 16:51

crb

7,998
1
38
53

Interesting, I may fool around with the impersonation code just for fun, but in the meantime I'll probably need accounts in each sub-domain. Thanks! – ewall Nov 14 '11 at 14:37

score 0 · Answer 2 · answered Nov 14 '11 at 04:57

0

What happens if you use psexec to execute the certutil.exe command on a domain controller belonging to each domain that you would like to target, using your trusted domain admin account from another domain in the forest?
Alternately, can you use your domain admin privileges to create a svc_certchk account in each domain?

answered Nov 14 '11 at 04:57

Skyhawk

14,200
4
53
95

As @crb mentioned, `certutil` runs in the user context, so no matter what DC I run it on it will run for the domain of the executing user account. Yes, I could create accounts in each domain, which is what I was trying to avoid, but I suppose that's the only reasonable option. – ewall Nov 14 '11 at 14:35

score 0 · Answer 3 · edited Dec 08 '14 at 20:21

After running into the same issue I was able to get the information I needed via Powershell thanks to someone else's blog post.

Credit: (original link if it's still online when you read this)

http://blogs.technet.com/b/heyscriptingguy/archive/2011/02/16/use-powershell-and-net-to-find-expired-certificates.aspx

Code:

$store = New-Object System.Security.Cryptography.X509Certificates.X509Store("\\dc1\My","LocalMachine")
$store.Open("ReadOnly")
$store.Certificates

You can then parse the resulting certificate objects. There may be some access issues to work through but it all worked fine for me in my environment using an Enterprise Administrator account against 2003 and 2008 servers.

Run `certutil -DCInfo` on a different target domain

3 Answers3