Run `certutil -DCInfo` on a different target domain

Question

It seems that running certutil.exe -DCInfo Verify will check the certificates for all domain controllers in the domain of the logged-in user account.

In our AD forest, we have a handful of domains. I only have a unique account in two of them, but have administrative permissions over all of them.

Is there a way I can run the command to target a different domain than the one I'm logged into, or do I really have to have an account in each one?!

Alternately, is there another way to accomplish the same goal?

Answer 1

certutil works in the user context from which it is called.

It seems unlikely that you will be able to achieve what you want without an account on each domain, unless you can think of a way to impersonate the other users - which would probably require calling into the Win32 API. Here's a SO question which might help you if you decide to go down that route.

Answer 2

1. What happens if you use psexec to execute the certutil.exe command on a domain controller belonging to each domain that you would like to target, using your trusted domain admin account from another domain in the forest?

2. Alternately, can you use your domain admin privileges to create a svc_certchk account in each domain?