Trace source of Certifcate that is being copied

[techie08]

Hi

 

I have a old certificate that is being copied to the Trusted Root Certification Authorities store on every windows computer and server. I cant for the life of me find where its coming from as i have checked all GPOs in Group Policy management console but i cant find anything

 

Has anyone got any on ideas on where to check?

 

Thanks

Edited October 14, 2013 by techie08

[techie08]

By process of elimination, the only place it looks like the certificate could be deployed from is the Default domain policy but again nothing is showing when editing the GPO.

[sted]

not being deployed by a script is it?

 

also there are some settings newer version of windows cant see but are still set. For example ris gpo still has the settings there for it and on 2003/2000/xp you can see and edit them on 7 iirc you cant same as you cant edit proxt settings 0n 2012/8 but the settings are still there

[techie08]

No it isn't. I loaded the GPMC on the remaining 2003 member server we have to see if it shows up on this but no luck. Its really weird!

[techie08]

After further testing, It seems that its only installing the cert after the computer is joined to the domain. If i delete the certificate after, run gpupdate numerous times, the certificate does not re-appear so where its pulling it from, is a mystery!

 

Edit: Forget the above, Its put it back in after a few restarts!

Edited October 14, 2013 by techie08

[techie08]

I think i have found where the certificate is located, See picture. Is it safe to delete these files or folders?