It seems that my version of Windows 7 (SP1, with PowerShell 4) lacks the certutil command. I tried to look for a way to add it manually but failed. Any ideas on how to do it?


Thanks to comments, I was able to locate the certutil.exe file in \System32\ but I can't execute any certutil command.

Here's a snapshot I have:

certutil running result

  • Which Win7 edition do you use? Home Premium or Pro/Ultimate? Maybe the Home misses it. – magicandre1981 Nov 13 '15 at 5:39
  • Actually it's the Ultimate 'distro' of Windows 7. – ahmed Nov 13 '15 at 7:32
  • 3
    Windows 7 Home Premium has it: C:\Windows\System32\certutil.exe – DavidPostill Nov 13 '15 at 13:53
  • 2
    I checked my Win7 ultimate VM and also has the file: "C:\Windows\System32\certutil.exe" – magicandre1981 Nov 13 '15 at 18:14
  • 1
    run it from a normal cmd.exe and not Powershell – magicandre1981 Nov 14 '15 at 8:00

Under powershell you must prefix the executable name by .\.

Try with .\certutil.exe or use the old school cmd instead of powershell.


When a program cannot be found when you can see that executable in file managers then it's usually because you're running a 32-bit shell, because 32-bit processes are put under file system redirector and System32 is actually SysWOW64. Some related questions:

In that case %windir%\Sysnative\certutil will work, although the better way would be running a 64-bit shell instead

However it seems that's not your situation because you can see certutil.exe in System32. So there are 2 possibilities:

  • Your PATH environment variable is broken so certutil.exe can't be found. %windir%\System32 must always be in PATH. Here's an example on my PC:

    PS C:\Users> $env:Path -replace ';', "`n"
    C:\Program Files\dotnet\

    Unlike cmd, PowerShell looks for the file in PATH first for security reasons, like POSIX shells. So even if you're inside %windir%\System32 it still won't run that exe file and you need to use .\certutil instead.

  • Your PATHEXT environment variable is broken. It's the extensions that the shell will look for when you type a command without extension and contains COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL by default. If there's no .exe in it then your file couldn't be found. You need to run certutil.exe explicitly

Either way, your system might be broken in some way and you need to run sfc /scannow to fix the system files and environment

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.