I have several computers to manage at home. Most of them run Windows 7 and we rely on peer-to-peer sharing between them. All the accounts exist with matching passwords on all the systems (we don't use Homegroups).
Up until now I've used an account that is a member of the Administrators group, but for security purposes I want to move away from this, so I have one system where my account is (experimentally) not in the Administrators group.
I have just completed my most recent jousting match with certificates (for code-signing software, in particular Excel macros, that I've written) and have made some observations about the MMC Certificates snap-in that I really can't explain. Typically, I run MMC and it requests elevation, I add the snap-in twice, once for my account's certificates and once for the system certificates.
The first observation, which I noticed quite a while ago, is that any certificates in the system stores are also visible in the user's corresponding stores. For lack of a better term, I'll refer to this effect as projection. It seems to occur at least in the Trusted Publishers and Trusted Root Certification Authorities stores but apparently not in the Personal store. As far as I can tell, there is no way to tell if a certificate shown by the snap-in is actually in the user store or projected from the system store.
The second observation is that, from the non-admin account, MMC starts with no UAC prompt, and I only get to add the snap-in for my own certificates. The projected system-level certificates still show up in the lists, but the Delete action is not available (it is not even in the context menu). This sort of makes sense, and provides a back-handed way to determine if it really is one of my own certificates, or just a projection of a system certificate.
This does not happen when MMC is run from an admin account, though; Instead I get the UAC prompt, and the snap-in can be added with a choice of my account, the system account, or a service account. In this case, the Delete action is available for all the certificates that appear to be in my user-level stores, and if the certificate happens to actually be in the system store, the Delete works anyway, which is generally Not What One Wants. It does not seem to be easy to run MMC in the non-admin mode from an admin account in order to avoid this ability to accidentally delete important stuff.
So my questions are:
- Is there any way, when MMC is running as admin, of determining if a certificate seen in a user-level store is actually stored there and not a projection of one in the system-level store?
- Is there any way, when logged in to an admin account, to run MMC and its certificate snap-ins as a non-admin, so system-level certificates can't be accidentally deleted? It turns out there are somewhat kludgy ways of doing this: this method adds a new verb to the context menus, maybe there are better ways that don't momentarily show a CMD window.
I'm going to continue investigating here.
So far, the MMC snap-in and the
cert: drive container objects in PowerShell show the projected certificates.
certutil -store and
certutil -viewstore do not show the projected certificates (and, in fact, show one certificate less in the system Trusted Publishers store, implying that there is yet another store involved which is projected into this store)
This may all be documented somewhere, but I haven't found it yet...