topic How to query a Windows server for a list of computer certificates and forward this to an index? in Getting Data In

How to query a Windows server for a list of computer certificates and forward this to an index?

msudhindra — Sat, 29 Aug 2015 11:29:01 GMT

Hello!

Our environment has a large number of Windows servers, and each of those servers gets a Computer certificate from an Enterprise PKI infrastructure.

Is there a way we can query the computer certificate stored on a Windows computer for a list of certificates issued, along with the expiration date for the certificate, and pull the data into an index?

Our Windows servers already have Universal forwarders installed on them.

Thanks in advance
Madan Sudhindra

Re: How to query a Windows server for a list of computer certificates and forward this to an index?

woodcock — Sat, 29 Aug 2015 16:19:00 GMT

You can use one of the methods to query your certificates here:

http://blogs.technet.com/b/heyscriptingguy/archive/2013/03/05/use-powershell-to-find-certificates-that-are-about-to-expire.aspx

Once you settle on a powershell command string, you can install this app that allows you to use any powershell command string as a Scripted Input as the Powershell Modular Input:

https://splunkbase.splunk.com/app/1477/