Before you start
Capture the current state, preserve recoverable data and record recent changes before remediation. Use production-impacting commands only within an approved maintenance or change window.
Define scope
Start with LocalMachine\My and add role-specific stores only when required. Document exclusions for certificates managed elsewhere. Never export private keys.
Collect metadata
Capture server, store, subject, thumbprint, issuer, expiration and remaining days. Use thumbprint as a stable identifier.
Classify risk
Define warning and critical thresholds appropriate to your renewal process. Treat already expired certificates as critical.
Export and alert
Write CSV or HTML with a collection timestamp. Keep column names stable if another system consumes the report.
Schedule safely
Run with minimum permissions. Test under the actual scheduled-task or automation identity because interactive and service contexts can differ.
Inventory
Get-ChildItem Cert:\LocalMachine\My | Select-Object Subject,Thumbprint,Issuer,NotAfterExpiry calculation
Get-ChildItem Cert:\LocalMachine\My | Select-Object Subject,Thumbprint,NotAfter,@{N='DaysRemaining';E={[math]::Floor(($_.NotAfter-(Get-Date)).TotalDays)}}Troubleshooting validation
- Confirm the original symptom is resolved.
- Verify dependent services and application health.
- Review logs or command output for secondary errors.
- Document the root cause and corrective action.
- Retain rollback evidence until the change is accepted.
Frequently Asked Questions
What should I check first?
Capture the current state, exact error, affected scope and recent changes before making changes. Then test the failing layer from the lowest dependency upward.
How do I validate the fix?
Repeat the original failing operation, check dependent services and confirm the issue remains resolved after any required restart or service recovery.
Can this troubleshooting be automated?
Automate read-only diagnostics first. Add remediation only after commands, permissions, logging and rollback behavior have been validated.