Nowadays everybody and their brother try to install their own root certificate into your Windows machine.
Sometimes they have a good reason, like Fiddler, but sometimes they don't.
Sir Mark Russinovich's added a feature to his old utitlity sigcheck.exe
using the -tv switch the program checks all certificates in the user or machine store and finds the ones that are not rooted in Microsoft trusted root certificate list.
So Microsoft keeps a master list of all the CA root certificates it trusts, and any certificate on your machine should be signed directly or via an intermediate by one of this certificates.
So the program shows a nice list of certificates that are not and you should review them and either delete them or make a mental note that they are okay.
Sometime in the future you run sigcheck again and you have to do the same.
Wouldn't it be easier to have it running periodically and alert you if any certs show up in the list. Also it would be nice to have a list of exceptions that are not signed by a trusted CA but still trusted by you, maybe because you created them yourself.
So I need something that would run every day, can give me alerts and allows for some configuration.
Luckily, I already had ServerMonitor.ps1 a PowerShell script that I created in 2007 and that has evolved over the years.
It checks various aspects of your Windows OS and alerts you via various methods. It has a plugin architecture, both providers that collect data and logger that send the result can be added by just dropping a file into the correct directory.
So, all I had to do is writing a new ServerMonitor3 provider that calls sigcheck to do the actual work.
Get the required files
Get sigcheck from TechNet, unblock and unzip it and put the files in a directory of your choice.
Go to my downloads page and get ServerManager3. Unblock the file and unzip it. All files should stay together but you can just drop them anywhere you want.
Configure ServerMonitor
In the same directory create a new text file name ServerMonitor3.xml, this is the default configuration file for ServerMonitor, but you could have many different ones if you want.
Edit the file, start with this:
<?xml version="1.0"?> <servermonitor version="3.0"> <loggers> <console enabled="true" /> </loggers> <certificates helper="C:\tools\sigcheck64.exe" store="machine" > </certificates> </servermonitor>
We define a single logger, just on the PowerShell console and a single provider the Certificates checker.
Now we have to tell it where sigcheck.exe is located, edit the helper attribute of the certificates node.
Now we can run the script:
C:\tools\servermonitor3\ServerMonitor3.ps3 -verbose
You have to adjust the path of course, the -verbose switch is just there so we see a little bit more what's going on, you don't need it.
If everything is fine, you will see a green success message, or you see some information about some certificates in yellow.
Now review these using certmgr.msc.
If you find you want to trust certain certificates, add them to your configuration file:
<certificates helper="C:\tools\sigcheck64.exe" store="machine" > <allow thumbprint="7E93B6DB9CB2E2D5A412628AE3C55D66DB1DF02620" remark="myCA" /> <allow thumbprint="C6C256DB9CB2EADFA41262E9FCE6DB9CB243DCB381" remark="Corp Root CA" /> </certificates>
The next time you run the script, it wont any longer complain about these.
Just having the results shown on the command line is not very helpful, you want to configure additional logger, the email one is most handy, the file one is also nice for logging purposes.
See the ServerMonitor page on how to configure these loggers.
Set up a scheduled task
Finally you want to run ServerMonitor every so often, set up a Windows Scheduled task to run the script.