1

I have several computers to manage at home. Most of them run Windows 7 and we rely on peer-to-peer sharing between them. All the accounts exist with matching passwords on all the systems (we don't use Homegroups).

Up until now I've used an account that is a member of the Administrators group, but for security purposes I want to move away from this, so I have one system where my account is (experimentally) not in the Administrators group.

I have just completed my most recent jousting match with certificates (for code-signing software, in particular Excel macros, that I've written) and have made some observations about the MMC Certificates snap-in that I really can't explain. Typically, I run MMC and it requests elevation, I add the snap-in twice, once for my account's certificates and once for the system certificates.

The first observation, which I noticed quite a while ago, is that any certificates in the system stores are also visible in the user's corresponding stores. For lack of a better term, I'll refer to this effect as projection. It seems to occur at least in the Trusted Publishers and Trusted Root Certification Authorities stores but apparently not in the Personal store. As far as I can tell, there is no way to tell if a certificate shown by the snap-in is actually in the user store or projected from the system store.

The second observation is that, from the non-admin account, MMC starts with no UAC prompt, and I only get to add the snap-in for my own certificates. The projected system-level certificates still show up in the lists, but the Delete action is not available (it is not even in the context menu). This sort of makes sense, and provides a back-handed way to determine if it really is one of my own certificates, or just a projection of a system certificate.

This does not happen when MMC is run from an admin account, though; Instead I get the UAC prompt, and the snap-in can be added with a choice of my account, the system account, or a service account. In this case, the Delete action is available for all the certificates that appear to be in my user-level stores, and if the certificate happens to actually be in the system store, the Delete works anyway, which is generally Not What One Wants. It does not seem to be easy to run MMC in the non-admin mode from an admin account in order to avoid this ability to accidentally delete important stuff.

So my questions are:

  1. Is there any way, when MMC is running as admin, of determining if a certificate seen in a user-level store is actually stored there and not a projection of one in the system-level store?
  2. Is there any way, when logged in to an admin account, to run MMC and its certificate snap-ins as a non-admin, so system-level certificates can't be accidentally deleted? It turns out there are somewhat kludgy ways of doing this: this method adds a new verb to the context menus, maybe there are better ways that don't momentarily show a CMD window.

I'm going to continue investigating here.

So far, the MMC snap-in and the cert: drive container objects in PowerShell show the projected certificates. certutil -store and certutil -viewstore do not show the projected certificates (and, in fact, show one certificate less in the system Trusted Publishers store, implying that there is yet another store involved which is projected into this store)

This may all be documented somewhere, but I haven't found it yet...

2
  • The MMC should be ran with the lowest permissions possible, unless you are specifically running it "as an Administrator", is that not happening? – Ramhound Feb 20 '20 at 22:48
  • Like regedit, mmc.exe contains a manifest that requests the highest available privilege. Preventing this requires using something like the linked article describes. – Kevin Martin Feb 21 '20 at 5:55
1

If you right-click on the Certificates - Current User node (possibly while it's selected?) you can open View->Options, and check "Physical certificate stores".

MMC Certificate Options Dialog

Then you can see the difference between certificates at the user level (Registry) and inherited from a linked store (Local Computer) in stores like the Root (Trusted Root Certification Authorities) stores:

MMC Certificates Snap-In with Physical Stores Enabled

The default mode in MMC shows the union of all the stores, because that's how the stores are viewed internally for making trust decisions.

2
  • Thanks, that explains it. That option is a bit obscure because you indeed must have the Certificates - Current User node selected, not just under the mouse, when you right-click, and Options is hidden under View too. The same menu item can be found in the form's View menu, again, only when Certificates - Current User is selected. – Kevin Martin Feb 21 '20 at 6:02
  • Furthermore, if I do the same to Certificates (Local Computer) I see that there are Registry certificates (which I haven't figured out how to show using certutil) and Enterprise certificates (which are the ones certutil -store -enterprise shows) – Kevin Martin Feb 21 '20 at 6:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.