Extending Hardware Inventory for System Center Configuration Manager

I would like to contribute by adding the certificate model output to the script.

## Delete any existing instances
$CurrentEA = $ErrorActionPreference
$ErrorActionPreference = 'SilentlyContinue'
(Get-WmiObject -Namespace root\cimv2 -class cm_CertInfo).Delete()
$ErrorActionPreference = $CurrentEA

## Create Class if it doesn't exist in root\cimv2
$newClass = New-Object System.Management.ManagementClass ("root\cimv2", [String]::Empty, $null);
$newClass["__CLASS"] = "cm_CertInfo";
$newClass.Qualifiers.Add("Static", $true)
$newClass.Properties.Add("Location", [System.Management.CimType]::String, $false)
$newClass.Properties["Location"].Qualifiers.Add("Key", $true)
$newClass.Properties.Add("Handle", [System.Management.CimType]::String, $false)
$newClass.Properties["Handle"].Qualifiers.Add("Key", $true)
$newClass.Properties.Add("Thumbprint", [System.Management.CimType]::String, $false)
$newClass.Properties.Add("Subject", [System.Management.CimType]::String, $false)
$newClass.Properties.Add("Issuer", [System.Management.CimType]::String, $false)
$newClass.Properties.Add("NotBefore", [System.Management.CimType]::String, $false)
$newClass.Properties.Add("NotAfter", [System.Management.CimType]::String, $false)
$newClass.Properties.Add("FriendlyName", [System.Management.CimType]::String, $false)
$newClass.Properties.Add("ExpiresinDays", [System.Management.CimType]::uint32, $false)
$newClass.Properties.Add("Template", [System.Management.CimType]::String, $false)
$newClass.Properties.Add("ScriptLastRan", [System.Management.CimType]::String, $false)
$newClass.Put()|Out-Null

function Publish-Certs2WMI{
    [CmdletBinding()]
    Param
    (
    # Path to Cert store to Publish
    [Parameter(Mandatory=$true,
    ValueFromPipelineByPropertyName=$true
    )]
    [ValidateScript({
        If(Test-Path "Cert:\$_"){$true}
        else{
            throw "Unable to access Certificates in $_ !!"
        }
    })]
    $Path
    )
    foreach ($Cert in (Get-ChildItem -Recurse cert:\$Path)){
        # Expires in...
            $ExpiresInDays = ($cert.NotAfter-(Get-Date)).TotalDays
            $ExpiresInDays = [int]$ExpiresInDays
            if ($ExpiresInDays -lt 0){
                $ExpiresInDays = 0
            }
            $Today = (Get-Date)
            $templateExt = $Cert.Extensions | Where-Object{ (($_.Oid.FriendlyName -eq 'Informações de Modelo de Certificado') -or ($_.Oid.FriendlyName -eq 'Certificate Template Information')) } | Select-Object -First 1

            if($templateExt) {
                $information = $templateExt.Format(1)
            
                # Extract just the template name in $Matches[1]
                if($information -match "^Template=(.+)\([0-9\.]+\)") {
                    set-wmiinstance -Namespace root\cimv2 -class cm_CertInfo -ErrorAction SilentlyContinue -argument @{
                        Location=$Path
                        Handle=$cert.Handle
                        Subject=$cert.subject
                        Issuer=$cert.Issuer
                        Thumbprint=$cert.thumbprint
                        NotBefore=$cert.NotBefore
                        NotAfter=$cert.NotAfter
                        FriendlyName=$cert.Friendlyname
                        ExpiresInDays=$ExpiresInDays
                        Template=$Matches[1]
                        ScriptLastRan=$Today
                    }|Out-Null
                } else {
                    # No regex match, just return the complete information then
                    set-wmiinstance -Namespace root\cimv2 -class cm_CertInfo -ErrorAction SilentlyContinue -argument @{
                        Location=$Path
                        Handle=$cert.Handle
                        Subject=$cert.subject
                        Issuer=$cert.Issuer
                        Thumbprint=$cert.thumbprint
                        NotBefore=$cert.NotBefore
                        NotAfter=$cert.NotAfter
                        FriendlyName=$cert.Friendlyname
                        ExpiresInDays=$ExpiresInDays
                        Template=$information
                        ScriptLastRan=$Today
                    }|Out-Null
                }
            } else {
                # No template name found
                    set-wmiinstance -Namespace root\cimv2 -class cm_CertInfo -ErrorAction SilentlyContinue -argument @{
                        Location=$Path
                        Handle=$cert.Handle
                        Subject=$cert.subject
                        Issuer=$cert.Issuer
                        Thumbprint=$cert.thumbprint
                        NotBefore=$cert.NotBefore
                        NotAfter=$cert.NotAfter
                        FriendlyName=$cert.Friendlyname
                        ExpiresInDays=$ExpiresInDays
                        Template=$null
                        ScriptLastRan=$Today
                    }|Out-Null
            }
    }
}

$CertPaths = 'LocalMachine\TrustedPublisher','LocalMachine\Root','LocalMachine\My'
foreach($CertPath in $CertPaths){Publish-Certs2WMI -Path $CertPath}

If(@(Get-WmiObject -Namespace root\cimv2 -class cm_CertInfo).count -gt 0){Write-Host "Compliant"}

Thank you all for your input and findings 🙂 Since the original content got a bit dated, I will touch base with the original author to get his take, and make updates to the content as necessary.

Well, it was all going great - until I found that the powershell script writes the NotBefore, NotAfter and ScriptLastRan0 values into WMI as CimType 'String' rather than 'DateTime'. The result from our environment was a variety of US/UK date formats and 12hr/24hr times stored as text. 

[BrandonWilson- no slight intended, this was still a great post and has already saved my bacon; just needed a little refinement for our use.]

Anyway, I'm working on an update to the powershell to rewrite the dates as CimType 'DateTime'; in the meantime the dates can be 'standardised' in the report SQL instead, for example:

SELECT
  v_GS_CM_CERTINFO.ExpiresinDays0
  ,v_R_System.Netbios_Name0
  ,v_R_System.Full_Domain_Name0
  ,v_GS_CM_CERTINFO.Issuer0
  ,v_GS_CM_CERTINFO.Subject0
  ,v_GS_CM_CERTINFO.FriendlyName0
  , case  right(v_GS_CM_CERTINFO.NotAfter0, 2) 
        when 'AM' then CONVERT(nvarchar, CONVERT(DATETIME, v_GS_CM_CERTINFO.NotAfter0, 101), 120)
        when 'PM' then CONVERT(nvarchar, CONVERT(DATETIME, v_GS_CM_CERTINFO.NotAfter0, 101), 120)
    else (substring(v_GS_CM_CERTINFO.NotAfter0, 7,4) + '-' + substring(v_GS_CM_CERTINFO.NotAfter0, 4,2) + '-' + left(v_GS_CM_CERTINFO.NotAfter0, 2)) + ' ' + right(v_GS_CM_CERTINFO.NotAfter0, 8) end as NotAfter0
  , case  right(v_GS_CM_CERTINFO.NotBefore0, 2)   
        when 'AM' then CONVERT(nvarchar, CONVERT(DATETIME, v_GS_CM_CERTINFO.NotBefore0, 101), 120)
        when 'PM' then CONVERT(nvarchar, CONVERT(DATETIME, v_GS_CM_CERTINFO.NotBefore0, 101), 120)
    else (substring(v_GS_CM_CERTINFO.NotBefore0, 7,4) + '-' + substring(v_GS_CM_CERTINFO.NotBefore0, 4,2) + '-' + left(v_GS_CM_CERTINFO.NotBefore0, 2)) + ' ' + right(v_GS_CM_CERTINFO.NotBefore0, 8) end as NotBefore0
  , case  right(v_GS_CM_CERTINFO.ScriptLastRan0, 2) 
        when 'AM' then CONVERT(nvarchar, CONVERT(DATETIME, v_GS_CM_CERTINFO.ScriptLastRan0, 101), 120)
        when 'PM' then CONVERT(nvarchar, CONVERT(DATETIME, v_GS_CM_CERTINFO.ScriptLastRan0, 101), 120)
    else (substring(v_GS_CM_CERTINFO.ScriptLastRan0, 7,4) + '-' + substring(v_GS_CM_CERTINFO.ScriptLastRan0, 4,2) + '-' + left(v_GS_CM_CERTINFO.ScriptLastRan0, 2)) + ' ' + right(v_GS_CM_CERTINFO.ScriptLastRan0, 8) end as ScriptLastRan0

FROM
  v_GS_CM_CERTINFO
  INNER JOIN v_R_System ON v_GS_CM_CERTINFO.ResourceID = v_R_System.ResourceID

This will output the dates as YYYY-MM-DD hh:mm:ss , for example 2020-02-20 12:34:56 (which is Excel-friendly, so will format nicely after exporting)

Hope this helps!

Likewise - very useful post, thanks!

Just one other thing; the "Publish Certificate Inventory" script has a slight flaw, due to the fact that powershell .Count - can't!

The final line reads (expanded for clarity):

If(  (Get-WmiObject -Namespace root\cimv2 -class cm_CertInfo).count -gt 0 ) {Write-Host "Compliant"}

but .Count returns nothing if the actual number of objects is one, due to some kind of array issue, so @ is needed:

If( @(Get-WmiObject -Namespace root\cimv2 -class cm_CertInfo).count -gt 0 ) {Write-Host "Compliant"}

Then all is tickety-boo.

Hope this helps!

Thanks Brandon for the great article! Exactly what we were looking for 😉

On the section importing certinfo.mof, it's worth noting that I was only able to do this within the default client settings hardware inventory. If attempting to import directly into the new custom HW inventory client settings, you receive the error below:  

By importing certinfo.mof into the default client settings, you can import but then disable, thereby creating the inventory classes and settings but not using them. You can then enable the certinfo class in your custom HW inventory settings, as it already exists. Bingo!

Thanks for the help!

Kind regards,

Marcus.