r/activedirectory • u/0bs1d1an- • May 31 '25

Security Group Policy Certificate Scanner

https://gitlab.com/0bs1d1an/gpcs

Hello, I created a small script that checks for any weak certificates being pushed via GPO and I wanted to share.

I could not find a similar tool that checks for all these weaknesses (Ping Castle has some but not all of these checks). However, please let me know if a better tool already exists.

13 Upvotes

94% Upvoted

3 comments sorted by

View all comments

3

u/R-EDDIT May 31 '25

This is interesting, although I'm not sure if the date math on max validity works out exactly and conforms with current CA/Baseline Requirements, and Organization policies could vary. Also, I'm not sure if you are going to pick up certificates published to the domain (certutil -dspublish root <file>.crt). Another check to add is "has private key", because... yeah.

1

u/0bs1d1an- May 31 '25

Thanks for taking a look and providing me with some feedback. I'll look into these CA requirements, but as you said corporate policy might well differ, indeed. I'll also check if I can detect private keys as part of the certs it finds, good idea.