Hello, How do you trace/report on certificate "Client Authentication" for the SCCM Agent expired? How does the certificate change from PKI to Self-Signed? when expired? So far the certificate self-signed are expired... I do a New Certificate request and restart the SMS Agent Host service and the PKI pops-up I then delete the old certificate Any recommendations. Thanks, Dom

Hi @Duchemin, Dominique ， We may navigate to CA to check for the SCCM Agent expired, instead of SCCM report. Here is the screenshot we could refer to: If the response is helpful, please click "Accept Answer" and upvote it. Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Hello, Could we get a report from AD? Thanks, Dom

Client Authentication not renewed

Duchemin, Dominique 2,006

Hello,

How do you trace/report on certificate "Client Authentication" for the SCCM Agent expired?
130820-2021-09-09-15-50-42-memcm-client-certificate-date.png

How does the certificate change from PKI to Self-Signed? when expired?
130911-2021-09-09-16-08-24-client-cetificate-pki-or-self.png

So far the certificate self-signed are expired...
I do a New Certificate request and restart the SMS Agent Host service and the PKI pops-up

I then delete the old certificate

Any recommendations.

Thanks,
Dom

2 answers

Amandayou-MSFT 11,046 Reputation points

2021-09-10T10:00:42.287+00:00

Hi @Duchemin, Dominique ，

We may navigate to CA to check for the SCCM Agent expired, instead of SCCM report.

Here is the screenshot we could refer to:

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment
Duchemin, Dominique 2,006 Reputation points

2021-09-10T14:04:57.227+00:00

Hello,

Could we get a report from AD?

Thanks,
Dom
Please sign in to rate this answer.
Amandayou-MSFT 11,046 Reputation points

2021-09-13T11:28:50.573+00:00

Hi,

We may not get the built-in report from AD, If possible, it requires the custom report to get the report we want from AD.

Here is the article about creating custom report, please refer to it:
https://systemcenterdudes.com/sccm-report-creation-report-builder/
Note: Non-Microsoft link, just for the reference.

Best regards,
Amanda

Duchemin, Dominique 2,006 Reputation points

2021-09-15T14:50:02.237+00:00

Hello,

The report https://blog.thomasmarcussen.com/using-sccm-ci-baseline-to-check-for-expiring-user-certificates/ is pointing to Users certificate and it is noted in bold "Again, the key thing here is to be sure that you deploy this CB to users and not to your systems!".

So should I change the deployment from Users to Computers as well as the path from "get-childitem -path cert:\currentuser..." in the script to "get-childitem -path cert:\LocalMachine"?

Set-Location Cert:\LocalMachine\My
Get-ChildItem -path cert:\LocalMachine\My

-ExpiringInDays failed for now checking why?
PS C:\Windows\system32> Get-ChildItem -ExpiringInDays 30 -recurse
Get-ChildItem : A parameter cannot be found that matches parameter name 'ExpiringInDays'.
At line:1 char:16

Get-ChildItem -ExpiringInDays 30 -recurse

~~~~~~~~~~~~~~~

CategoryInfo : InvalidArgument: (:) [Get-ChildItem], ParameterBindingException

FullyQualifiedErrorId : NamedParameterNotFound,Microsoft.PowerShell.Commands.GetChildItemCommand

I will try
get-childitem -path Cert:\LocalMachine\My -recurse | where { $_.notafter -le (get-date).AddDays(624)}

Thanks,
Dom

Amandayou-MSFT 11,046 Reputation points

2021-09-17T09:40:05.933+00:00

Hi,

Thanks for your update.

We could try this method, this article is not from Microsoft, so it is recommended that we use the custom script to achieve this target.

Thanks for your understanding.

Best regards,
Amanda
Sign in to comment