I am attempting to trigger a task schedule to kick off a powershell script based on when a new certificate is added into the Local Computer\Personal\Certificates store.

For testing purposes, the certificates, are self-signed, created using openssl.

As the certificates are generated, non-pkcs12 do not trigger the event found in event viewer's Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational.

However, the pkcs12 certificates do.

Any ideas how to get non-pkcs12 certificates to do the same?


How about having a script that is called periodically that writes the thumbprints of all existing certs to a file? Each time it runs, if a new thumbprint is found that isn't in the file, it can trigger whatever the rest of your script needs to do, and update the file.

$file = ".\certsSeenBefore.txt"
# make sure the above file exists
If (-not (Test-Path $file)) { New-Item $file -ItemType File }

# for each cert, see if the thumbprint is in the file
Get-ChildItem Cert:\LocalMachine\My\ | foreach {
    if ((Get-Content($file)) -contains $_.Thumbprint)
        # all good
        Write-Host "Ah Ha! THere's a new cert $_.Subject"

        # Add the thumbprint to the file so it doesn't get triggered again.
        Add-Content $file -Value $_.Thumbprint

        # call whatever it is you need to do

        # ....


Apologies, I know this isn't a complete answer, but don't have enough foo to be able to comment.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.