Security MVP Vadims Podans just did a great post on using PowerShell to remove expired user certificates from Active Directory.
In a nutshell,
- If your company is using certificates for user authentication or encryption, these expire every now and then,
- Your Enterprise CA in that case appends new certificates to users’ userCertificate attribute, while leaving expired certs there as well,
- Over time these increasingly clutter your AD, making administration more difficult and negatively affecting AD replication traffic.
Luckily, cleaning up expired certificates with PowerShell is extremely easy.
To do the clean-up for a specific user you can run this one-liner:
Get-QADUser username | Remove-QADCertificate -Valid:$false
To clean-up the entire domain, just do:
Get-QADUser | Remove-QADCertificate -Valid:$false
See Vadim’s original post for details.
Read more about PKI management with PowerShell here.
Subscribe by email
Dmitry's Blog: Cloud, PowerShell and beyond 
Great quick tip!
Do you know how to make a powershell script that can display the number of published certificates a user has from the Published Certificates Tab in AD? Can you do it so it displays the number of certificates every user in the domain has.
Next, can you make it so it outputs only he users with only more than xx number of certs?
How would you do PowerShell command for the following:
1. Get a report for all users with expired certs and how many certs they have (not delete the certs, just query which users have expired certs)
2. Get report for users that have more than x number of certs
3. Delete certificates for users that have more than x number of certs