PowerShell Certificates

Get-ChildItem Cert:\LocalMachine\My |
    Select-Object Subject, Issuer, NotAfter,
    @{N='DaysLeft';E={($_.NotAfter - (Get-Date)).Days}},
    Thumbprint | Sort-Object NotAfter | Format-Table

Get-ChildItem Cert:\LocalMachine\My | Where-Object {
    $_.EnhancedKeyUsageList.FriendlyName -contains "Client Authentication"
} | Select-Object Subject, Issuer, NotAfter, Thumbprint

Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Issuer -match "CHLASUBCA" } |
    Format-List Subject, Issuer, NotBefore, NotAfter, Thumbprint, EnhancedKeyUsageList

Get-ChildItem Cert:\LocalMachine\My | ForEach-Object {
    $source = switch -Regex ($_.Issuer) {
        'CHLASUBCA'                    { 'AD CS (Enterprise)' }
        'Microsoft Intune'             { 'Intune MDM' }
        'MS-Organization-Access'       { 'Entra ID (AAD)' }
        'Device Management'            { 'Intune Device' }
        default                        { 'Other' }
    }
    [PSCustomObject]@{
        Source  = $source
        Subject = $_.Subject.Substring(0, [Math]::Min(60, $_.Subject.Length))
        Expires = $_.NotAfter
        EKU     = ($_.EnhancedKeyUsageList.FriendlyName -join ', ')
    }
} | Sort-Object Source | Format-Table -AutoSize

$threshold = (Get-Date).AddDays(30)
Get-ChildItem Cert:\LocalMachine\My |
    Where-Object { $_.NotAfter -lt $threshold -and $_.NotAfter -gt (Get-Date) } |
    Select-Object Subject, NotAfter, @{N='DaysLeft';E={($_.NotAfter - (Get-Date)).Days}}

'LocalMachine','CurrentUser' | ForEach-Object {
    Get-ChildItem "Cert:\$_\My" | Where-Object { $_.NotAfter -lt (Get-Date) } |
    Select-Object @{N='Store';E={$_}}, Subject, NotAfter
} | Format-Table

Get-ChildItem Cert:\LocalMachine\My | Where-Object Subject -like "*chla*" |
    Format-List Subject, Issuer, NotBefore, NotAfter, Thumbprint,
    HasPrivateKey, EnhancedKeyUsageList, SerialNumber

$cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Issuer -match "CHLASUBCA" } | Select-Object -First 1
$templateExt = $cert.Extensions | Where-Object { $_.Oid.Value -eq "1.3.6.1.4.1.311.21.7" }
if ($templateExt) { $templateExt.Format($true) }

$cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Issuer -match "CHLASUBCA" } | Select-Object -First 1
$chain = New-Object Security.Cryptography.X509Certificates.X509Chain
$valid = $chain.Build($cert)
Write-Host "Chain valid: $valid"
if (-not $valid) { $chain.ChainStatus | ForEach-Object { Write-Host "  Error: $($_.Status)" -ForegroundColor Red } }

Get-ChildItem Cert:\LocalMachine\My | Where-Object {
    $_.EnhancedKeyUsageList.FriendlyName -contains "Client Authentication"
} | Select-Object Subject, HasPrivateKey, NotAfter

Get-ChildItem Cert:\LocalMachine\Root | Where-Object { $_.Subject -match "CHLA" } |
    Select-Object Subject, Thumbprint, NotAfter

Get-ChildItem Cert:\LocalMachine\CA | Where-Object { $_.Subject -match "CHLA" } |
    Select-Object Subject, Thumbprint, NotAfter

netsh wlan show profile name="CHLA_Staff"                        (1)
netsh wlan show profile name="CHLA-Remote"                       (2)

netsh wlan export profile name="CHLA_Staff" folder="$env:TEMP" key=clear
[xml]$profile = Get-Content "$env:TEMP\Wi-Fi-CHLA_Staff.xml"
$profile.WLANProfile.MSM.security.OneX.EAPConfig.OuterXml

netsh lan show profiles interface="Ethernet"
netsh lan export profile folder="$env:TEMP" interface="Ethernet"

certutil -pulse                                                  (1)
gpupdate /force                                                  (2)

certreq -enroll -q "Workstation Authentication"

certutil -config - -ping

Get-WinEvent -LogName "Microsoft-Windows-WLAN-AutoConfig/Operational" -MaxEvents 30 |
    Where-Object { $_.Message -match "802.1X|EAP|TEAP|authentication|fail|success" } |
    Select-Object TimeCreated, Id, LevelDisplayName,
    @{N='Summary';E={$_.Message.Split("`n")[0]}} | Format-Table -Wrap

Get-WinEvent -LogName "Microsoft-Windows-Wired-AutoConfig/Operational" -MaxEvents 30 |
    Select-Object TimeCreated, Id, LevelDisplayName,
    @{N='Summary';E={$_.Message.Split("`n")[0]}} | Format-Table -Wrap

Get-WinEvent -LogName "System" -MaxEvents 100 |
    Where-Object { $_.ProviderName -eq "Schannel" } |
    Select-Object TimeCreated, LevelDisplayName,
    @{N='Summary';E={$_.Message.Split("`n")[0]}} | Format-Table -Wrap

# Enable (one-time, Admin):
wevtutil set-log Microsoft-Windows-CAPI2/Operational /enabled:true

# Read:
Get-WinEvent -LogName "Microsoft-Windows-CAPI2/Operational" -MaxEvents 20 |
    Select-Object TimeCreated, @{N='Summary';E={$_.Message.Split("`n")[0]}}

$cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Issuer -match "CHLASUBCA" } | Select-Object -First 1
Export-Certificate -Cert $cert -FilePath "$env:TEMP\machine-cert.cer"

$cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Issuer -match "CHLASUBCA" } | Select-Object -First 1
$password = ConvertTo-SecureString -String "ExportP@ss!" -Force -AsPlainText
Export-PfxCertificate -Cert $cert -FilePath "$env:TEMP\machine-cert.pfx" -Password $password

Import-Certificate -FilePath "C:\certs\enterprise-root-ca.cer" -CertStoreLocation Cert:\LocalMachine\Root

certutil -store My                                               (1)
certutil -store My "THUMBPRINT"                                  (2)
certutil -verify "C:\certs\cert.cer"                             (3)
certutil -dump "C:\certs\cert.cer"                               (4)
certutil -pulse                                                  (5)
certutil -config - -ping                                         (6)
certutil -CATemplates                                            (7)
certutil -viewstore "REQUEST"                                    (8)
certutil -repairstore My "THUMBPRINT"                            (9)

netsh wlan show profile name="CHLA_Staff"                        (1)
netsh wlan show profile name="CHLA-Remote"                       (2)

netsh wlan show profiles
# Group Policy profiles (read only) — pushed by GPO, can't delete locally
# User profiles — locally created, can export/delete

netsh wlan export profile name="CHLA_Staff" folder="$env:TEMP" key=clear

[xml]$profile = Get-Content "$env:TEMP\Wi-Fi-CHLA_Staff.xml"

# Authentication method
$auth = $profile.WLANProfile.MSM.security.authEncryption
Write-Host "Authentication: $($auth.authentication)"
Write-Host "Cipher: $($auth.encryption)"
Write-Host "Use 802.1X: $($auth.useOneX)"

# EAP config (TEAP Type=55, TLS Type=13, MSCHAPv2 Type=26)
$eapConfig = $profile.WLANProfile.MSM.security.OneX.EAPConfig
if ($eapConfig) {
    Write-Host "`nEAP Configuration:"
    $eapConfig.OuterXml
}

[xml]$profile = Get-Content "$env:TEMP\Wi-Fi-CHLA_Staff.xml"
$eapType = $profile.WLANProfile.MSM.security.OneX.EAPConfig.EapHostConfig.EapMethod.Type.'#text'
$eapName = switch ($eapType) {
    '13'  { 'EAP-TLS (certificate only)' }
    '21'  { 'EAP-TTLS' }
    '25'  { 'PEAP' }
    '26'  { 'MSCHAPv2' }
    '55'  { 'EAP-TEAP (tunnel, multiple inner methods)' }
    default { "Unknown ($eapType)" }
}
Write-Host "EAP Method: $eapName (Type $eapType)"

netsh lan show profiles interface="Ethernet"
netsh lan export profile folder="$env:TEMP" interface="Ethernet"

$wiredProfiles = Get-ChildItem "$env:TEMP" -Filter "Ethernet*.xml"
if ($wiredProfiles) {
    [xml]$wired = Get-Content $wiredProfiles[0].FullName
    $wired.LANProfile.MSM.security | Format-List
}

Write-Host "=== EAP-TEAP requires ===" -ForegroundColor Cyan
Write-Host "1. Machine cert with Client Authentication EKU"
Write-Host "2. Issued by trusted CA (in Root/CA stores)"
Write-Host "3. Private key present"
Write-Host "4. Not expired"
Write-Host "5. Trust chain complete (Root CA → Sub CA → Machine cert)"

$cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object {
    $_.EnhancedKeyUsageList.FriendlyName -contains "Client Authentication" -and
    $_.HasPrivateKey -and
    $_.NotAfter -gt (Get-Date)
} | Select-Object -First 1

if ($cert) {
    Write-Host "`nCandidate cert found:" -ForegroundColor Green
    Write-Host "  Subject: $($cert.Subject)"
    Write-Host "  Issuer:  $($cert.Issuer)"
    Write-Host "  Expires: $($cert.NotAfter) ($(($cert.NotAfter - (Get-Date)).Days) days)"

    $chain = New-Object Security.Cryptography.X509Certificates.X509Chain
    $valid = $chain.Build($cert)
    Write-Host "  Chain:   $(if($valid){'VALID'}else{'BROKEN'})" -ForegroundColor $(if($valid){'Green'}else{'Red'})
} else {
    Write-Host "`nNO VALID CERT FOUND — EAP-TEAP will fail" -ForegroundColor Red
    Write-Host "Run: certutil -pulse   (to trigger auto-enrollment)"
}

Get-WinEvent -LogName "Microsoft-Windows-WLAN-AutoConfig/Operational" -MaxEvents 50 |
    Where-Object { $_.Id -in @(8001,8002,8003,11001,11002,11004,11010) } |
    Select-Object TimeCreated, Id,
    @{N='Event';E={switch($_.Id){8001{'Connected'}8002{'ConnFailed'}8003{'Disconnected'}11001{'AuthStarted'}11002{'AuthSuccess'}11004{'AuthFailed'}11010{'NotAvailable'}}}},
    @{N='Summary';E={$_.Message.Split("`n")[0]}} | Format-Table -Wrap

Get-WinEvent -LogName "Microsoft-Windows-Wired-AutoConfig/Operational" -MaxEvents 50 |
    Where-Object { $_.Id -in @(15500,15501,15503) } |
    Select-Object TimeCreated, Id,
    @{N='Event';E={switch($_.Id){15500{'AuthStarted'}15501{'AuthSuccess'}15503{'AuthFailed'}}}},
    @{N='Summary';E={$_.Message.Split("`n")[0]}} | Format-Table -Wrap

$since = (Get-Date).AddHours(-24)
Get-WinEvent -LogName "Microsoft-Windows-WLAN-AutoConfig/Operational" |
    Where-Object { $_.TimeCreated -gt $since -and $_.Id -in @(8002,11004) } |
    Select-Object TimeCreated, Id, Message | Format-List

Get-WinEvent -LogName "Security" -MaxEvents 100 |
    Where-Object { $_.Id -in @(6272,6273,6274,6278) } |
    Select-Object TimeCreated, Id,
    @{N='Event';E={switch($_.Id){6272{'NPS Granted'}6273{'NPS Denied'}6274{'NPS Discarded'}6278{'NPS Extension DLL'}}}},
    @{N='Summary';E={$_.Message.Split("`n")[0]}} | Format-Table -Wrap

Write-Host "`n=== dot3svc / Wlansvc Status ===" -ForegroundColor Cyan
Get-Service -Name dot3svc, Wlansvc | Select-Object Name, Status, StartType | Format-Table

Write-Host "=== Machine Cert (Client Auth EKU) ===" -ForegroundColor Cyan
$certs = Get-ChildItem Cert:\LocalMachine\My | Where-Object {
    $_.EnhancedKeyUsageList.FriendlyName -contains "Client Authentication"
}
if (-not $certs) { Write-Host "  NO CLIENT AUTH CERT FOUND" -ForegroundColor Red }
else {
    $certs | ForEach-Object {
        $chain = New-Object Security.Cryptography.X509Certificates.X509Chain
        $valid = $chain.Build($_)
        [PSCustomObject]@{
            Subject    = $_.Subject.Substring(0, [Math]::Min(50, $_.Subject.Length))
            Issuer     = $_.Issuer.Substring(0, [Math]::Min(40, $_.Issuer.Length))
            Expires    = $_.NotAfter
            DaysLeft   = ($_.NotAfter - (Get-Date)).Days
            PrivateKey = $_.HasPrivateKey
            ChainValid = $valid
        }
    } | Format-Table
}

Write-Host "=== Enterprise Root CA in Trust Store ===" -ForegroundColor Cyan
Get-ChildItem Cert:\LocalMachine\Root | Where-Object { $_.Subject -match "CHLA" } |
    Select-Object Subject, NotAfter | Format-Table

Write-Host "=== Wired 802.1X Status ===" -ForegroundColor Cyan
netsh lan show interfaces

Write-Host "`n=== WiFi 802.1X Status ===" -ForegroundColor Cyan
netsh wlan show interfaces | Select-String -Pattern "State|SSID|Authentication|802.1X"

Write-Host "`n=== Recent Auth Failures (last 24h) ===" -ForegroundColor Cyan
$since = (Get-Date).AddHours(-24)
$failures = @()
try {
    $failures += Get-WinEvent -LogName "Microsoft-Windows-WLAN-AutoConfig/Operational" -ErrorAction SilentlyContinue |
        Where-Object { $_.TimeCreated -gt $since -and $_.Id -in @(8002,11004) }
} catch {}
try {
    $failures += Get-WinEvent -LogName "Microsoft-Windows-Wired-AutoConfig/Operational" -ErrorAction SilentlyContinue |
        Where-Object { $_.TimeCreated -gt $since -and $_.Id -eq 15503 }
} catch {}
if ($failures) {
    $failures | Select-Object TimeCreated, Id, @{N='Summary';E={$_.Message.Split("`n")[0]}} | Format-Table -Wrap
} else { Write-Host "  No auth failures in last 24 hours" -ForegroundColor Green }