PowerShell access denied to cert:\CurrentUser\My

Question

PS cert:\currentuser\my> dir  
Get-ChildItem : Access is denied.
At line:1 char:3
+ dir <<<<

I cannot access any of my code signing certificates to sign a PowerShell script. I can open MMC, Certificates, and see that my code signing certificates are installed and valid on my machine (Windows XP SP 3).

The other weird thing is that I cannot access any of my mapped network drives from PowerShell, but I can see them fine in Windows Explorer and a DOS window.

I've uninstalled PowerShell, rebooted, and re-installed PowerShell 1, but still have the same problem.

EDIT: My day-to-day account on this machine is NOT an administrator, but I do have an administrator account I can use for tasks that require it. The code signing certificate is assigned to my day-to-day account, and I should not have to be an administrator to sign code. I'm not sure how to give this account rights to the certificate store.

EDIT 2: I ran FileMon and RegMon to see what I am being denied access to. cert:CurrentUser\My is the folder C:\Documents and Settings\USERNAME\Application Data\Microsoft\SystemCertificates\My\Certificates. It also denied me access to C:\Documents and Settings\USERNAME\Local Settings\Temp. I can open Explorer and get to the files in these folders with no problem. I temporarily gave Everyone full rights to these folders and still received the access denied message from PowerShell.

Google hasn't revealed much. What should I do?

Message from Windows PowerShell event log:

Provider Health: Attempting to perform the GetChildItems operation on  
the 'Certificate' provider failed for path '\currentuser\my'. Access is denied.

Details: 
ProviderName=Certificate
ExceptionClass=ProviderInvocationException
ErrorCategory=InvalidOperation
ErrorId=GetChildrenProviderException
ErrorMessage=Attempting to perform the GetChildItems operation on  
       the 'Certificate' provider failed for path '\currentuser\my'.  
       Access is denied.

Severity=Warning
SequenceNumber=146

HostName=ConsoleHost
HostVersion=1.0.0.0
     .....  

Answer 1

Sounds like you have permissions issues.

Is this an admin account on this PC, are you subject to domain controls, and are there group policies enabled?

I'm guessing this PC is locked down more than PowerShell would like. Some admins won't allow it to run at all since it's possible to do some damage.

When you run Set-ExecutionPolicy RemoteSigned do you get any errors?

Answer 2

PowerShell runs through the .NET Framework. I've not used XP for a while, bit if I remember correctly, there is some weird .NET user in the user list. I never got around to figuring out what that was for, but maybe you need to give that user NTFS rights to the directory in question.

Answer 3

I discovered why this was happening. If I just run PowerShell from the menu I have problems accessing certificates and other resources. For example, if I just run it and navigate to my home directory and run "dir", I get this:

PS C:\Documents and Settings\username> dir
Get-ChildItem : Access to the path 'C:\Documents and Settings\username' is denied.
At line:1 char:3
+ dir <<<<
PS C:\Documents and Settings\username>

Yet I can use Windows Explorer or a DOS window to successfully list the contents.

What works is when I right click on PowerShell and select "Run As," leave it on the current user, and uncheck the "Protect my computer and data from unauthorized program activity." After this I can list my home directory and I can access the certificate I need to sign my code.

My DEP settings are grayed out, which means they are pushed by a group policy, or I need to elevate to Administrator to change it. I logged in as an Administrator and found that DEP is on for essential Windows programs and services only. I guess PowerShell falls into this category. Now that I can access the certificate I have discovered that the private key can't be found. I think this can be fixed by having the certificate reissued.

Answer 4

Try running Set-ExecutionPolicy Unrestricted in powershell