Get-ChildItem Cert:\ (Locally executed) vs. Invoke-Command results difference confusion?

user_453544 0
Viewed 408

I am working on the code below. I am trying to determine why the result is different, given the script command line is the same.

Executed Locally from SVRAD1:

Get-ChildItem Cert:\ -ExpiringInDays 365 -Recurse | where-object {$_.subject -like "*Microsoft*"} | Select-Object ThumbPrint, FriendlyName, Subject, NotAfter, HasPrivateKey, Issuer | ogv

The result shows 4x SSL Certs:

enter image description here

Executed Locally from my laptop against SVRAD1:

$DCList = 'SVRAD1'
Invoke-Command -Computer $DCList {
    Get-ChildItem Cert:\ -ExpiringInDays 365 -Recurse | where-object {$_.subject -like "*Microsoft*"} | Select-Object ThumbPrint, FriendlyName, Subject, NotAfter, HasPrivateKey, Issuer
} | ogv

The result shows only 2x SSL Certs:

enter image description here

powershell
1 Answers

As you can see, the certificate is doubled while running locally as evident from the thumbprint, and this has to do with the current user. Add to your list of objects

..., PSPath | ogv

or PSParentPath. You will see the two duplicates have

Certificate:LocalMachine
Certificate:CurrentUser

in their base. So, you are seeing the same certificate accessed in two different paths. Of course, when you run remotely the current user certificate will be missing, and you only see the local machine one (local machine is the remote SVRD in this case where the command runs, not your own).

user_68812400
Related