Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

So we have a situation where a contractor deployed about 200 Windows 7 computers that were cloned improperly. The SCCM cert was not cleaned off the reference machine before it was sysprepped. Now because of the duplicate certs, the SCCM console is getting crapped up with invalid device records all over the place.

I need to script the removal of the bad cert on all these machines but I don't know how to do it from the command line. I assume I would be using Certutil.exe but I can't figure out what arguments to pass. I'm also familiar with WMI and VBScript, so if there were a certificate class I could use that would would work too.

I appreciate any help anyone could offer.

share|improve this question
    
What version of Windows? Specifically what version of WMF is out there on your clients? –  kce Jun 6 at 18:00
1  
Hah. Win7. My bad for not mentioning that. I edited the post –  Wes Sayeed Jun 6 at 18:02
    
Are we talking about the computer certificate? –  BigHomie Jun 6 at 18:26
1  
For clarification, I'm talking about the SCCM certificate that the SCCM client automatically generates on the machine when it gets installed. –  Wes Sayeed Jun 6 at 18:28

2 Answers 2

up vote 4 down vote accepted

You could use PSEXEC to remotely reinstall the SCCM client and reset the key to all 200 computers.

psexec @c:\lists\NeedSccm.txt -u domain\admin -h -d "\\SCCMSERVER\SHARE$\ccmsetup.exe" RESETKEYINFORMATION=TRUE
share|improve this answer
    
Brilliant. This is exactly the kind of thing I was looking for. I want to run it on a couple machines to test it out first. How would I verify right away that it's been reset? –  Wes Sayeed Jun 6 at 20:37
    
Communication between the computer and the server will be (re)established so you will see them pop up in the SCCM console. –  Bin Jun 12 at 12:47

I don't know about an SCCM certificate, as our clients use the autorequested domain certificate for client auth. However, I still may be able to help. Navigate to the cert store in powershell, like so:

PS Cert:\LocalMachine\My> Get-ChildItem


    Directory: Microsoft.PowerShell.Security\Certificate::LocalMachine\My


Thumbprint                                Subject                                                                                                                           
----------                                -------                                                                                                                           
A34F86ACC5HAHAYEAHRIGHTF731B798EF24F6D6D0B  CN=BIG-HOMIEPC, OU=Computers, DC=eng, DC=mit, DC=edu                                                       
5DAC23B07490B5C602EC4F04GEDDABOUDIT94FF41A  CN=localhost                                                                                                                      

Once there, simply remove the certificate with the proper subject,

PS Cert:\LocalMachine\My> Get-ChildItem | where {$_.Subject -like "*DC=end, DC=mit, DC=edu*"} | Remove-Item -WhatIf

This will work in a script as well.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.