How to query a Windows server for a list of computer certificates and forward this to an index?

[msudhindra]

Hello!

Our environment has a large number of Windows servers, and each of those servers gets a Computer certificate from an Enterprise PKI infrastructure.

Is there a way we can query the computer certificate stored on a Windows computer for a list of certificates issued, along with the expiration date for the certificate, and pull the data into an index?

Our Windows servers already have Universal forwarders installed on them.

Thanks in advance
Madan Sudhindra

[woodcock]

You can use one of the methods to query your certificates here:

http://blogs.technet.com/b/heyscriptingguy/archive/2013/03/05/use-powershell-to-find-certificates-th...

Once you settle on a powershell command string, you can install this app that allows you to use any powershell command string as a Scripted Input as the Powershell Modular Input:

https://splunkbase.splunk.com/app/1477/