Local User Certificate audit

Content Authoring
1

I am trying to create a BigFix task that runs “certutil -store -user my” and pipe it to a text file to audit in an analysis. When I run the job I see the cmd window open and the data fly by but when I go to the text file it is blank. I tried running it as system and runascurrentuser with the same result.

I also tried putting it into a batch file and when I call the batch file with BigFix the script runs but does not pipe to the output file. If I run the script manually it populates the file.

This line of code Creates blank file when run through BigFix but works in fixlet debugger
waithidden cmd.exe /C certutil -store -user my > c:\Temp\Logfile.txt

this code also creates the batch file but when run produces a blank file but works when run manually.
createfile until __EOF
certutil -store -user my > c:\Temp\Logfile.txt
__EOF
delete "c:\Temp\file.bat"
move __createfile "c:\Temp\file.bat"
waithidden __Download\RunAsCurrentUser.exe cmd.exe /C c:\Temp\file.bat

Any ideas what I am missing here? Seems like I am really close but its just not piping the output to the file.

2

I think Certutil is deprecated, but should still work. I’d try turning off wow64 redirection, and also output any error messages to the file.

createfile until __EOF
certutil -store -user my > c:\Temp\Logfile.txt 2>&1
__EOF
delete "c:\Temp\file.bat"
move __createfile "c:\Temp\file.bat"
Action uses wow64 redirection false
waithidden __Download\RunAsCurrentUser.exe cmd.exe /C c:\Temp\file.bat
1 Like
3

Thanks

Not sure if that fixed my issue or the fact that I was using an old RunAsCurrentUser.exe that might have been part of the problem too. In any sense, its working now and thanks for helping out, now i can start my vacation.