3

I need to deploy a certificate to a mix of Windows machines, including XP, Win7, Server 2003 and 2008, for the purposes of using Locally Published Updates with WSUS. This is a Samba 3 network, so there are no GPO or similar tools available to me.

This question asks the same basic question but the OP in that case was able to utilise SCCM, which we don't have. Is there a viable way of doing this without the use of GPO or machine startup scripts (the implementation of which presents the same problems as I am currently facing)?

Improve this question
4
  • 1
    Have you ever considered adding a reference to a startup script in Local Group Policy on your domain clients? I don't support any Samba3-based networks but, if I did, I'd strongly consider having all the machines refer to a central startup script so that I could get a "hook" to run arbitrary commands on each machine on boot (not at all unlike Group Policy). That startup script would be a great place to deploy this certificate, in the case of this question.
    – Evan Anderson
    Jan 14, 2013 at 2:59
  • Yes, I have considered it but I'm new to Samba and have yet to learn my way around it sufficiently to know what is and isn't possible, let alone how to do it (I've only been here just over a week and there are more urgent things to learn). However, we will be moving to Samba4 "soon", which I believe will give me Group Policies and other goodies that normally require AD.
    – John Gardeniers
    Jan 14, 2013 at 9:44
  • I'd love to hear how Samba4 works for you. I don't have the spare cycles to look at it right now, but I suspect it's still a long way from being a feature-complete replacement for Windows Server hosting Active Directory. I'd love to setup a test lab with it in my copious free time... >smile<
    – Evan Anderson
    Jan 14, 2013 at 13:58
  • As I said, we'll be implementing it "soon", where "soon" is defined as a period of time somewhere between now and who-knows-when. :)
    – John Gardeniers
    Jan 15, 2013 at 2:08

2 Answers 2

Reset to default
1

I believe you could use the certutil utility to install the certificate

Perhaps the following link may help:

http://mumblestiltskin.blogspot.com.au/2010/06/automating-installingimporting-pfx.html

He has detailed a couple of scenarios and a batch file that deploys a certificate to the local machine store.

Improve this answer
1
  • I found that on Win7, and probably Server 2008 as well, it needs to be run as Administrator, which I need to spend some time on solving.
    – John Gardeniers
    Jan 11, 2013 at 4:05
0

The link posted by Enigman got me pretty close but the certificate I have is a cer, not a pfx (which I've never come across before). Plus the certificate needs to be put in two places on each machine. The solution which worked for me was to use these two lines in a batch file:

psexec \\target -s -u domain\user -p password "\\full_path_to certutil\certutil.exe" -addstore -f root "\\full_path_to_certificate\wsus_certificate.cer"
psexec \\target -s -u domain\user -p password "\\full_path_to certutil\certutil.exe" -addstore -f TrustedPublisher "\\full_path_to certutil\wsus_certificate.cer"

An important point to remember, at least for Win7 and Server 2008 targets, and I presume 2012 also, is that the batch file must be run as Administrator on the machine sending out the commands, which is a key step I'd left out previously. The username used in the commands should of course also have admin rights on the target.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .