I have recently set up mandatory profiles for a PC image I am creating and I have been able to set up everything I need in the profiles via group policy with the exception of one major item. Apparently mandatory profiles do not allow the installation of certificates in the personal store (pfx/p12 certs.) This is a deal breaker because one of our vendors requires a personal certificate installed. I would like to avoid moving away from mandatory profiles over this one caveat so I'm trying anything I can to workaround this. I feel like I am very close but I have hit a wall at the last step..here is what I have devised so far:
- I have discovered that by manually editing the State value of the registry subkey under the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\%userSID% from 21001 (Which is what designates it as a mandatory profile) to 0 (which designates it as a local profile) I can trick the computer into thinking it is a local profile and it will allow the certificate to install.
- I have had a powershell script written that queries the current logged in users SID and then edits the State value for me.
- This script requires admin privileges to run, but it needs to run under a non-admin account at login. I am currently trying to get this to work by deploying a scheduled task via group policy that runs the script at logon with administrator credentials.
- in order for this to work I need to set "Run whether user is logged in or not" in the scheduled task but doing so causes the script to run- but not work. (The registry key does not update.)
It looks to me like the problem is that the task scheduler cannot run an interactive script with the run whether the user is logged in or not checkbox is ticked. Does anybody have any ideas of what I can do get this working? I'm not familiar enough with scripting to know if its possible to update my script so that it is a non-interactive script that can update this registry key.
I'm also not attached to the script by no means- if there is another way to get this certificate installed automatically Thanks for any and all support everyone. I have a couple more ideas to look into that I think may or may not work but my lack of experience leaves me unsure, such as-
Perhaps it is possible to create the mandatory profile in a way so that while it acts like a mandatory profile (Deletes the profile and loads a default one in its place at user login) the state will be created as "0" when the profile is created (rather than a 21001)
Perhaps it is possible to write something (in a language other than Powershell) that will change the registry key for me at login that can be set to "Run whether user is logged in or not" as an admin.
Perhaps there is a way to manually install the certificate into my system rather than using the certificate installer or certutil. It looks to me that when installing the certificate on the mandatory profile the certificate will install in the personal store but the website will not authenticate. Maybe it is incorrectly storing the certificates password?
Any guidance or ideas are greatly appreciated, I feel like I'm so close but so far away.. Thanks all!